Capturing Live Network Data

4.6. Capture files and file modes

While capturing, the underlying libpcap capturing engine will grab the packets from the network card and keep the packet data in a (relatively) small kernel buffer. This data is read by Ethereal and saved into the capture file(s) the user specified.

Different modes of operation are available when saving this packet data to the capture file(s).

Tip!

Working with large files (several 100 MB's) can be quite slow. If you plan to do a long term capture or capturing from a high traffic network, think about using one of the "Multiple files" options. This will spread the captured packets over several smaller files which can be much more pleasant to work with.

Note!

Using Multiple files may cut context related information. Ethereal keeps context in- formation of the loaded packet data, so it can report context related problems (like a stream error) and keeps information about context related protocols (e.g. where data is exchanged at the establishing phase and only referred to in later packets). As it keeps this information only for the loaded file, using one of the multiple file modes may cut these contexts. If the establishing phase is saved in one file and the things you would like to see is in another, you might not see some of the valuable context related inform- ation.

Tip!

Information about the folders used for the capture file(s), can be found in Appendix A, Configuration (and other) Files and Folders.

Table 4.1. Capture file mode selected by capture options

"File" option

"Use

multiple

"Ring

buffer

Mode

 

Resulting filename(s) used

 

files" option

with n

files" op-

 

 

 

 

 

 

 

tion

 

 

 

 

 

 

 

 

 

 

 

 

 

-

-

 

-

 

Single temporary

etherXXXXXX

(where

 

 

 

 

 

file

 

XXXXXX is a unique number)

 

 

 

 

 

 

 

 

foo.cap

-

 

-

 

Single named file

foo.cap

 

 

 

 

 

 

 

 

 

foo.cap

x

 

-

 

Multiple

files,

foo_00001_20040205110102.cap

 

 

 

 

 

continuous

 

,

 

 

 

 

 

 

 

 

foo_00002_20040205110102.cap

 

 

 

 

 

 

 

, ...

 

 

 

 

 

 

 

 

 

foo.cap

x

 

x

 

Multiple

files,

foo_00001_20040205110102.cap

 

 

 

 

 

ring buffer

 

,

 

 

 

 

 

 

 

 

foo_00002_20040205110102.cap

 

 

 

 

 

 

 

, ...

 

 

 

 

 

 

 

Single temporary file

 

A temporary file will be created and used (this is the default).

 

 

 

 

After the capturing is stopped, this file can be saved later un-

 

 

 

 

der a user specified name.

 

 

Single named file

 

A single capture file will be used. If you want to place the

69

Page 83
Image 83
Lucent Technologies Ethereal manual Capture files and file modes, Capture file mode selected by capture options