Re: Proposed new pcap format

[Stephen Donnelly <stephen () endace com>]

Ronnie Sahlberg wrote:
> > > Yes, fully fledged decoded captures would use a lot of extra disk, but a
> > > raw no-frills capture could be recorded with maybe only 50% or so
> overhead.
>
> > 50% extra space and 50% extra disk bandwidth cost? So my 250 Megabyte per
> > second pcap stream to disk becomes 375MB/s?
>
> I would be extatic if the captures people send to me would be tiny 250
> MByte.
> Some people work with captures that are 1GByte in size and bigger.

If you read my email again, you will notice I said 250 megabytes per second. 
This is an expression of a data rate, not a file size. The captured file size 
will be determined by the rate, multiplied by the capture time. E.g. 250MB/s * 
24 hours.

Stephen.
--
-----------------------------------------------------------------------
    Stephen Donnelly BCMS PhD           email: sfd () endace com
    Endace Technology Ltd               phone: +64 7 839 0540
    Hamilton, New Zealand               cell:  +64 21 1104378
-----------------------------------------------------------------------

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.