Ethereal-users: [Ethereal-users] Question on ring buffer and duration

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Richard Bejtlich <taosecurity@xxxxxxxxx>
Date: Sat, 16 Jul 2005 09:35:31 -0400
Hello,

I noticed that ring buffer syntax I wrote about last year in my first
book no longer works, e.g.

bourque:/root# tethereal -n -i ngeth0 -s 1515 -a duration:3600 -b 24 -w test.lpc
tethereal: Ring buffer requested, but no maximum capture file size was
specified.

Now it seems a filesize has to be added?

bourque:/root# tethereal -n -i ngeth0 -s 1515 -a filesize:1000000 -a
duration:3600 -b 24 -w test.lpc

Can anyone explain why this was done?  Is it a sanity check to prevent
filling  a partition?

Thank you,

Richard