Shark SE400 User's Guide download pdf (Page 87)

Capturing Live Network Data

Using Multiple files may cut context related information. Wireshark keeps context information of the

loaded packet data, so it can report context related problems (like a stream error) and keeps information

about context related protocols (e.g. where data is exchanged at the establishing phase and only referred

to in later packets). As it keeps this information only for the loaded file, using one of the multiple file

modes may cut these contexts. If the establishing phase is saved in one file and the things you would

like to see is in another, you might not see some of the valuable context related information.

Information about the folders used for capture files can be found in Appendix B, Files and Folders.

Table 4.1. Capture file mode selected by capture options

“File” option “Use multiple

files” option

“Ring buffer with

n files” option

Mode Resulting

filename(s) used

- - - Single temporary

file

wiresharkXXXXXX

(where XXXXXX

is a unique

number)

foo.cap - - Single named file foo.cap

foo.cap x - Multiple files,

continuous

foo_00001_20100205110102.cap,

foo_00002_20100205110318.cap,

…

foo.cap x x Multiple files, ring

buffer

foo_00001_20100205110102.cap,

foo_00002_20100205110318.cap,

…

Single temporary file A temporary file will be created and used (this is the default).

After capturing is stopped this file can be saved later under a

user specified name.

Single named file A single capture file will be used. If you want to place the new

capture file in a specific folder choose this mode.

Multiple files, continuous Like the “Single named file” mode, but a new file is created and

used after reaching one of the multiple file switch conditions

(one of the “Next file every …” values).

Multiple files, ring buffer Much like “Multiple files continuous”, reaching one of the

multiple files switch conditions (one of the “Next file every

…” values) will switch to the next file. This will be a newly

created file if value of “Ring buffer with n files” is not reached,

otherwise it will replace the oldest of the formerly used files

(thus forming a “ring”).

This mode will limit the maximum disk usage, even for an

unlimited amount of capture input data, only keeping the latest

captured data.

4.12. Link-layer header type

In most cases you won’t have to modify link-layer header type. Some exceaptions are as follows:

If you are capturing on an Ethernet device you might be offered a choice of “Ethernet” or “DOCSIS”.

If you are capturing traffic from a Cisco Cable Modem Termination System that is putting DOCSIS

traffic onto the Ethernet to be captured, select “DOCSIS”, otherwise select “Ethernet”.

If you are capturing on an 802.11 device on some versions of BSD you might be offered a choice of

“Ethernet” or “802.11”. “Ethernet” will cause the captured packets to have fake (“cooked”) Ethernet

1 2 ... 82 83 84 85 86 87 88 89 90 91 92 ... 227 228

Comments to this Manuals

No comments

Shark SE400 User's Guide Page 87

Comments to this Manuals

Related products and manuals for Vacuum cleaners Shark SE400