Is this still the case? I'm testing with v0.5.8 and it seems the answer is yes, but wasn't sure things have changed in later rc releases. I am also interested in rolling pcap based on both size and time intervals.
On Wednesday, February 5, 2014 5:45:36 PM UTC-8, Jon Schipp wrote: > By design, if you choose the same option more than once the last one takes > effect. Support for more than > > one interval type is not available at this time. You may try using logrotate > or a script to aid or send a patch. > > > > > On Wed, Feb 5, 2014 at 3:43 PM, <[email protected]> wrote: > > Hi, > > > > I would like to have netsniff-ng rotate the capture file if a particular time > has passed or a particular size has been reached. > > > > The options are: --interval 60sec --interval 10MiB > > > > The full line is: > > > > /usr/sbin/netsniff-ng -V --silent --in em1 --filter icmp and host x.x.x.x > --ring-size 25MiB --interval 60sec --interval 10MiB --prefix eth1. --out > /var/opt/capture/ --bind-cpu 4 > > > > > > It seems to be taking the size and not the time when rotating. > > > > I use a similar thing on tshark and I am trying to duplicate it here. > > > > Ideas? > > > > Thanks in advance! > > > > John > > > > -- > > You received this message because you are subscribed to the Google Groups > "netsniff-ng" group. > > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > > -- > Jon Schipp, > > jonschipp.com, sickbits.net -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
