On Mon, Oct 28, 2002 at 09:25:23AM +0530, Mudium, Ravi Kumar (Ravi) wrote: > Hi I am trying to implement a circular file so that I can avoid any crash of > ETHEREAL when there is no sufficient space on the disk. > But I am not able to find out where exactly the write happens in to the > capture file.
That's a developer's question, not a user's question, so it should have gone to [EMAIL PROTECTED]; I'm CCing that list rather than ethereal-users. > Can some one help me in finding out the same. In Ethereal, it happens in "capture_pcap_cb()". Look for "wtap_dump". Note, however, that the libpcap capture file format that is Ethereal's native format doesn't support circular files - the N+1st packet in a capture is always immediately after the Nth packet, it can never be before that packet. Note also that there is already a ring buffer mechanism in Ethereal that rotates amongst several files.
