Ethereal-dev: [Ethereal-dev] Re: [Ethereal-users] NEED HELP

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 28 Oct 2002 12:45:48 -0800
On Mon, Oct 28, 2002 at 09:25:23AM +0530, Mudium, Ravi Kumar (Ravi) wrote:
> Hi I am trying to implement a circular file so that I can avoid any crash of
> ETHEREAL when there is no sufficient space on the disk.
> But I am not able to find out where exactly the write happens in to the
> capture file.

That's a developer's question, not a user's question, so it should have
gone to ethereal-dev@xxxxxxxxxxxx; I'm CCing that list rather than
ethereal-users.

> Can some one help me in finding out  the same.

In Ethereal, it happens in "capture_pcap_cb()".  Look for "wtap_dump".

Note, however, that the libpcap capture file format that is Ethereal's
native format doesn't support circular files - the N+1st packet in a
capture is always immediately after the Nth packet, it can never be
before that packet.

Note also that there is already a ring buffer mechanism in Ethereal that
rotates amongst several files.