Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: [Ethereal-users] Questions on using ethereal / tethereal

[Laurent Deniel <laurent.deniel@xxxxxxx>]

Laurent Deniel wrote:

> so it might be the time to implement the following at the switch :
>
> - close the previous one
>
> - open the next one (and truncate it if not empty)
>
> with a maximum number of files either increased (64 hardcoded or set in 
> preferences) or
> unlimited like Guy suggested ...
>
> According to your remarks, I will implement this.

Checked in CVS. Refer to the change log :

  Ring buffer almost completely rewritten in order to:

  - be able to use a unlimited number of ringbuffer files

    0 specified with -b argument or in the GUI, means that the number of file
    is unlimited.

    else the maximum number of ring buffer files is arbitrarily set to 1024.

  - close the current file and open (truncating it) the next file at switch

  - set the final file name once open (or reopen)

  - avoid the deletion of files that could not be truncated (can't arise now)
    and do not erase empty files

  The idea behind that is to remove the limitation of the maximum # of
  ringbuffer files being less than the maximum # of open fd per process
  and to be able to reduce the amount of virtual memory usage (having only
  one file open at most) or the amount of file system usage (by truncating
  the files at switch and not the capture stop, and by closing them which
  makes possible their move or deletion after a switch).

If everybody is OK with these changes, we might also change the GUI to
specify "unlimited" instead of 0 ...

Laurent