Wireshark · Ethereal-users: Re: [Ethereal-dev] Re: [Ethereal-users] Questions on using ethereal / tethereal

[Jack Jackson <jack@xxxxxxxxxxxxxxx>]

At 02:04 PM 6/18/2003, Laurent Deniel wrote:

> Ian Schorr wrote:
>
> > > 1.) Why is ethereal / tethereal not capable to capture more than 10
> > > tracefiles in ringbuffer mode ?
> > Very good question.  I've asked before but never really found an 
> > explanation.  10 is an arbitrarily set limit, and I don't know why it's 
> > so low.  It's also limited by "FOPEN_MAX", which appears to be 16 in 
> > Linux but doesn't appear to have any relation to the maximum number of 
> > fopen()s allowed.  Personally, I've removed these limitations (and set a 
> > fixed max of 1000 files), and not noticed any side-effects under Win2K, 
> > WinXP, and Linux.
>
> There is no problem to increase such a limit (the maximum number of
> open files is usually high enough on moderm Unices, and on old ones,
> a limit of 64 comes in mind). So it is safe (no impact on current code)
> to increase from 10 to at least 64 without problems ...
>
> But the question is : why do you need so many files ? and could you tune
> the maximum file size instead of the number of files ...

The reason I want it is to limit the size of each file.  Ethereal, at least 
on Win2K, seems to consume quite a bit of memory for the protocol tree.  If 
the file is very large it will crash.