This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark(dumpcap, tshark), ringbuffer problem from command line

1

Hello, Please help me with the following problem.

I'm using ringbuffer to limit the number of files and size. Unfortunately this option is not working or I'm doing something wrong.

The below command should make only 5 files, but actually like is displayed is not deleting the files that are exceeded the number configured.

I'm using the wireshark Version 1.4.0 (SVN Rev 34005 from /trunk-1.4), it is a portable version, but this error is happening also under Linux Sles11.

.dumpcap.exe -i 6 -b filesize:10 -b files:5 -w D:wiresharktest.pcap

File: D:wiresharktest_00001_20101209112524.pcap

Packets: 116 File: D:wiresharktest_00002_20101209112539.pcap

Packets: 167 File: D:wiresharktest_00003_20101209112539.pcap

Packets: 238 File: D:wiresharktest_00004_20101209112547.pcap

Packets: 322 File: D:wiresharktest_00005_20101209112559.pcap

Packets: 380 File: D:wiresharktest_00006_20101209112607.pcap

Packets: 442 File: D:wiresharktest_00007_20101209112615.pcap

Packets: 544 File: D:wiresharktest_00008_20101209112637.pcap

Packets: 621 Packets dropped: 0

Thank you,

This question is marked "community wiki".

asked 09 Dec '10, 02:22

longelas's gravatar image

longelas
1113
accept rate: 0%

edited 09 Dec '10, 02:53

I'm using tshark that is installed with "Version 1.4.2 (SVN Rev 34959 from /trunk-1.4)". This works properly for me (only creating the five files at about 10K each. I'm not running Linux at the moment. I tested this on Windows.

(09 Dec '10, 03:34) Paul Stewart

One Answer:

0

Hello,

Thank you is working now. I dont think it was an wireshark(dumpcap, thsark) error.

answered 09 Dec '10, 04:56

longelas's gravatar image

longelas
1113
accept rate: 0%

edited 09 Dec '10, 04:58