Hello, Please help me with the following problem. I'm using ringbuffer to limit the number of files and size. Unfortunately this option is not working or I'm doing something wrong. The below command should make only 5 files, but actually like is displayed is not deleting the files that are exceeded the number configured. I'm using the wireshark Version 1.4.0 (SVN Rev 34005 from /trunk-1.4), it is a portable version, but this error is happening also under Linux Sles11. .dumpcap.exe -i 6 -b filesize:10 -b files:5 -w D:wiresharktest.pcap File: D:wiresharktest_00001_20101209112524.pcap Packets: 116 File: D:wiresharktest_00002_20101209112539.pcap Packets: 167 File: D:wiresharktest_00003_20101209112539.pcap Packets: 238 File: D:wiresharktest_00004_20101209112547.pcap Packets: 322 File: D:wiresharktest_00005_20101209112559.pcap Packets: 380 File: D:wiresharktest_00006_20101209112607.pcap Packets: 442 File: D:wiresharktest_00007_20101209112615.pcap Packets: 544 File: D:wiresharktest_00008_20101209112637.pcap Packets: 621 Packets dropped: 0 Thank you, This question is marked "community wiki". asked 09 Dec '10, 02:22  longelas edited 09 Dec '10, 02:53 |
One Answer:
Hello, Thank you is working now. I dont think it was an wireshark(dumpcap, thsark) error. answered 09 Dec '10, 04:56 longelas edited 09 Dec '10, 04:58 |
I'm using tshark that is installed with "Version 1.4.2 (SVN Rev 34959 from /trunk-1.4)". This works properly for me (only creating the five files at about 10K each. I'm not running Linux at the moment. I tested this on Windows.