Lucent Technologies Ethereal - Manual (Page 157)

on the creation date and time.
When the first capture file fills up, Ethereal will switch to
writing to the next file, until it fills up the last file, at which
point it'll discard the data in the first file (unless 0 is spe-
cified, in which case, the number of files is unlimited) and
start writing to that file and so on.
If the optional duration is specified, Ethereal will switch also
to the next file when the specified number of seconds has
elapsed even if the current file is not completely fills up.
:v
al
durationue Switch to the next file after value seconds have
elapsed, even if the current file is not com-
pletely filled up.
:val
filesizeue Switch to the next file after it reaches a size of
value kilobytes (where a kilobyte is 1000 bytes,
not 1024 bytes).
files:value Begin again with the first file after value num-
ber of files were written (form a ring buffer).
-B <capture buffer size (Win32
only)> Win32 only: set capture buffer size (in MB, default is 1MB).
This is used by the the capture driver to buffer packet data un-
til that data can be written to disk. If you encounter packet
drops while capturing, try to increase this size.
-c <capture packet count> This option specifies the maximum number of packets to cap-
ture when capturing live data. It would be used in conjunction
with the -k option.
-f <capture filter> This option sets the initial capture filter expression to be used
when capturing packets.
-g <packet number> After reading in a capture file using the -r flag, go to the giv-
en packet number.
-h The -h option requests Ethereal to print its version and usage
instructions (as shown above) and exit.
-i <capture interface> The -i option allows you to specify, from the command line,
which interface packet capture should occur on if capturing
packets.
An example would be: ethereal -i eth0.
To get a listing of all the interfaces you can capture on, use
the command ifconfig -a or netstat -i. Unfortunately, some
versions of UNIX do not support ifconfig -a, so you will have
to use netstat -i in these cases.
-k The -k option specifies that Ethereal should start capturing
packets immediately. This option requires the use of the -i
parameter to specify the interface that packet capture will oc-
cur from.
-l This option turns on automatic scrolling if the packet list pane
is being updated automatically as packets arrive during a cap-
ture ( as specified by the -S flag).
-L List the data link types supported by the interface and exit.
Customizing Ethereal
143