Wireshark mailing list archives
Re: tshark or dumpcap ring buffer limitations
From: Jaap Keuter <jaap.keuter () xs4all nl>
Date: Wed, 19 May 2010 21:21:23 +0200
Hi, But do you really want that many files in you file system? Thanks, Jaap On 05/19/2010 08:48 PM, Joseph Laibach wrote:
Jaap, Sounds great, but I have no clue about compiling. Looks like it's time for some more reading and experimenting. Thanks Joe -----Original Message----- From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Jaap Keuter Sent: Wednesday, May 19, 2010 2:35 PM To: Community support list for Wireshark Subject: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations Hi, It's hardcoded, so you can get the source, increase the limit, recompile and go. Thanks, Jaap On 05/19/2010 08:17 PM, Joseph Laibach wrote:Is there a way to remove that limit or override it? Thanks Joe -----Original Message----- From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Jaap Keuter Sent: Wednesday, May 19, 2010 2:07 PM To: Community support list for Wireshark Subject: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations On 05/19/2010 07:38 PM, Joseph Laibach wrote:All, I'm running a continuous capture of data. I'm trying to use a ring buffer of 25000 files with an 8mb file size. The problem is that the ring buffer starts overwriting after 10000 files. I've tried it with dumpcap and tshark. The command is using the -b files:25000 -b filesize:8192. Is there a limitation to the size of the ring buffer for dumpcap and/or tshark? Thanks Joe - Wireshark V1.2.8 - Windows 2003 Server R2 64bit - WinPcap v4.1.1Hi, That's a fixed limit: jaap@host:~/src/wireshark/trunk$ grep RINGBUFFER_MAX_NUM_FILES *.h ringbuffer.h:#define RINGBUFFER_MAX_NUM_FILES 10000 Thanks, Jaap
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- tshark or dumpcap ring buffer limitations Joseph Laibach (May 19)
- Re: tshark or dumpcap ring buffer limitations Jaap Keuter (May 19)
- Re: tshark or dumpcap ring buffer limitations Joseph Laibach (May 19)
- Re: tshark or dumpcap ring buffer limitations Jaap Keuter (May 19)
- Re: tshark or dumpcap ring buffer limitations Joseph Laibach (May 19)
- Re: tshark or dumpcap ring buffer limitations Jaap Keuter (May 19)
- Re: tshark or dumpcap ring buffer limitations Joseph Laibach (May 19)
- Re: tshark or dumpcap ring buffer limitations Jaap Keuter (May 19)
- Re: tshark or dumpcap ring buffer limitations Jeff Morriss (May 20)
- Re: tshark or dumpcap ring buffer limitations Joseph Laibach (May 19)
- Re: tshark or dumpcap ring buffer limitations Ryan Zuidema (May 19)
- Re: tshark or dumpcap ring buffer limitations Jaap Keuter (May 19)
- Re: [Wireshark-users] tshark or dumpcap ring buffer limitations Jaap Keuter (May 20)
- Re: [Wireshark-users] tshark or dumpcap ring buffer limitations Sake Blok (May 21)
- Re: [Wireshark-users] tshark or dumpcap ring buffer limitations Gerald Combs (May 21)
- Re: [Wireshark-users] tshark or dumpcap ring buffer limitations Jeff Morriss (May 21)
- Re: [Wireshark-users] tshark or dumpcap ring buffer limitations Jeff Morriss (May 25)