Wireshark-bugs: [Wireshark-bugs] [Bug 12212] Ring Buffer files not saved with the file extension
Jim Young
changed
bug 12212
| What |
Removed |
Added |
| CC |
|
jyoung@gsu.edu
|
Comment # 1
on bug 12212
from Jim Young
Hello Andy,
At a minimum the ring buffer created file names use a filename template of
"_NNNNN_YYYYMMDDhhmmss". But you can optionally add a prefix and/or suffix by
entering a name in the file name text entry box.
If you only enter the path name and do not enter any file name component, then
all created files simply follow the standard template with NNNNN initially
starting at 00001 (e.g. "_00001_20120229235413").
If you enter just a simple single element file name like "test2", then all the
ring-buffer created files have a prefix of "test2" (e.g.
"test2_00001_20120229235655".
If you enter a two component file name such as "test3.pcap" then the
ring-buffer created files will have a prefix of "test3" and a suffix of ".pcap"
(e.g. "test3_00001_20120229235830.pcap").
If you enter JUST a suffix such as ".pcapng" (note the initial "." character),
then the ring buffer created files will look like this
"_00001_201203010037.pcapng".
If you enter a file name with multiple "." components such as
"test5.wifi.pcapng", then all but the right-most component is added as the
prefix and only the right-most component is added as the suffix. The file
names would look like "test5.wifi_00001_201203010954.pcapng"
Should a suffix of .pcap or .pcapng be added automatically? I can understand
some expecting the ring-buffer created files to include a file name suffix
consistent with the type of output file selected. But I personally prefer the
current behavior because I use non-standard suffixes to convey information for
subsequent trace file processing.
I don't believe this to be a bug but I'll leave it to you to make that choice.
You are receiving this mail because:
- You are watching all bug changes.
