Re: [tcpdump] New feature to limit capture file size (#464)

[Darren Reed <darrenr () netbsd org>]

On 10/06/2015 5:42 AM, Michael Richardson wrote:
> re: https://github.com/the-tcpdump-group/tcpdump/pull/464 Guy writes:
> > We have the -C option, giving a file size in megabytes (real 
> > megabytes, i.e. 1,000,000 bytes, not 1,048,576 bytes); once the file 
> > gets that big, tcpdump switches to a new file. 
> > This adds another file size option, with a different syntax for the 
> > size option, and with tcpdump stopping rather than rotating files 
> > when it reaches that size. 
> > We also have the -G option, to rotate files based on time rather than 
> > size. 
> > We might want to consider cleaning up these options a bit, so that we 
> > can specify "stop" vs. "rotate" and "file size" rather than "capture 
> > time" independently. 
> thoughts? I'm happy to accept the patch once sane, and then clean it 
> up as Guy suggests.


Maybe it is time to work out how this should interact now...

Why is there even a need to have -G and -C?
Aren't both really just the same feature? (file rotation)
But with a different parameter?
Why can't it be "-C 1h,500M"? (rotate after 500M or 1h)
... and so on.

I think the "We might want to..." paragraph is right but that more thought
is needed.

Darren

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers