Wireshark · Wireshark-users: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

It's hardcoded, so you can get the source, increase the limit, recompile and go.

Thanks,
Jaap

On 05/19/2010 08:17 PM, Joseph Laibach wrote:
> Is there a way to remove that limit or override it?
>
> Thanks
>
> Joe
>
> -----Original Message-----
> From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
> Sent: Wednesday, May 19, 2010 2:07 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations
>
> On 05/19/2010 07:38 PM, Joseph Laibach wrote:
> > All,
> >
> > I'm running a continuous capture of data. I'm trying to use a ring
> > buffer of 25000 files with an 8mb file size. The problem is that the
> > ring buffer starts overwriting after 10000 files. I've tried it with
> > dumpcap and tshark. The command is using the -b files:25000 -b
> > filesize:8192. Is there a limitation to the size of the ring buffer for
> > dumpcap and/or tshark?
> >
> > Thanks
> >
> > Joe
> >
> > - Wireshark V1.2.8
> >
> > - Windows 2003 Server R2 64bit
> >
> > - WinPcap v4.1.1
>
> Hi,
>
> That's a fixed limit:
>
> jaap@host:~/src/wireshark/trunk$ grep RINGBUFFER_MAX_NUM_FILES *.h
> ringbuffer.h:#define RINGBUFFER_MAX_NUM_FILES 10000
>
> Thanks,
> Jaap