Wireshark · Ethereal-users: [Ethereal-users] ring buffer file modification times

["Michael L. Artz" <dragon@xxxxxxxxxxxxx>]

I am using the 'ring buffer' functionality of tethereal (stock RH9, 
ethereal 0.9.8), and have run into a little problem.  I am trying to 
process the ring buffer files using a rather naive little perl script.  
Basically, I do an 'lt -tr' on the directory where the ring buffer files 
are being created, and process all of the files except the latest one, 
since I assume that that is file that is currently being written. 

Occcasionally, however, the latest file is *not* the one that is 
currently being written, but the one that was just finished (i.e. 'ls 
-tr' will result in .001, .002, .004, .003).  Is this some cleanup that 
tethereal is doing to the file after it has started on the new file, or 
should I look somewhere else for the problem?  I assume that my good old 
'ls' should be working OK, but I could always stat the files within perl.

Thanks
-Mike