diff options
author | morriss <morriss@f5534014-38df-0310-8fa8-9805f1628bb7> | 2010-05-27 19:11:53 +0000 |
---|---|---|
committer | morriss <morriss@f5534014-38df-0310-8fa8-9805f1628bb7> | 2010-05-27 19:11:53 +0000 |
commit | ef799f9e400d5e65642e65c4b46c93cf51e7f1b3 (patch) | |
tree | 12f86d9ceca976a22bc6918e27cf742eafa8cc93 /doc/dumpcap.pod | |
parent | 8a47ad5d4edffb29296be30030fe7db74da3e515 (diff) |
Document the maximum number of files in a ring buffer, including a warning about using large numbers of files.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@32999 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'doc/dumpcap.pod')
-rw-r--r-- | doc/dumpcap.pod | 30 |
1 files changed, 19 insertions, 11 deletions
diff --git a/doc/dumpcap.pod b/doc/dumpcap.pod index 292d52adde..220d099728 100644 --- a/doc/dumpcap.pod +++ b/doc/dumpcap.pod @@ -58,14 +58,16 @@ Specify a criterion that specifies when B<Dumpcap> is to stop writing to a capture file. The criterion is of the form I<test>B<:>I<value>, where I<test> is one of: -B<duration>:I<value> Stop writing to a capture file after I<value> seconds have elapsed. +B<duration>:I<value> Stop writing to a capture file after I<value> seconds have +elapsed. -B<filesize>:I<value> Stop writing to a capture file after it reaches a size of I<value> -kilobytes (where a kilobyte is 1024 bytes). If this option -is used together with the -b option, dumpcap will stop writing to the -current capture file and switch to the next one if filesize is reached. +B<filesize>:I<value> Stop writing to a capture file after it reaches a size of +I<value> kilobytes (where a kilobyte is 1024 bytes). If this option is used +together with the -b option, dumpcap will stop writing to the current capture +file and switch to the next one if filesize is reached. -B<files>:I<value> Stop writing to capture files after I<value> number of files were written. +B<files>:I<value> Stop writing to capture files after I<value> number of files +were written. =item -b E<lt>capture ring buffer optionE<gt> @@ -94,10 +96,16 @@ B<filesize>:I<value> switch to the next file after it reaches a size of I<value> kilobytes (where a kilobyte is 1024 bytes). B<files>:I<value> begin again with the first file after I<value> number of -files were written (form a ring buffer). This option requires either -B<duration> or B<filesize> to be specified to control when to go to the next -file. It should be noted that each B<-b> parameter takes exactly one criterion; -to specify two criterion, each must be preceded by the B<-b> option. +files were written (form a ring buffer). This value must be less than 100000. +Caution should be used when using large numbers of files: some filesystems do +not handle many files in a single directory well. The B<files> criterion +requires either B<duration> or B<filesize> to be specified to control when to +go to the next file. It should be noted that each B<-b> parameter takes exactly +one criterion; to specify two criterion, each must be preceded by the B<-b> +option. + +Example: B<-b filesize:1024 -b files:5> results in a ring buffer of five files +of size one megabyte. =item -B E<lt>capture buffer sizeE<gt> @@ -192,7 +200,7 @@ link types can be used for the B<-y> option. =item -M -When used with B<-D>, B<-L> and B<-S>, print machine-readable output. +When used with B<-D>, B<-L> and B<-S>, print machine-readable output. The machine-readable output is intended to be read by B<Wireshark> and B<TShark>; its format is subject to change from release to release. |