When using multiple ring buffers based on filesize (-b filesize:N) in 0.99, only the first file is the requested size - all subsequent files are of varying size but contain only one packet. In a live capture, this makes for serious (200k+ files in a directory) issues. The Ethereal buglist has seen a rash of newly-posted bugs about this (all dupes, as mine was), so I thought I'd try to head off the Gentoo crowd here. This is fixed in development versions (which I've verified), but has not been released in other than the SVN snapshots. You may want to consider masking this - I don't know.
Does the patch set in here [0] fix this issue for you? [0]: http://anonsvn.ethereal.com/viewcvs/viewcvs.py?rev=18032&view=rev I don't see a problem with applying patches from upstream's svn.
I have not tried that specific patch to 0.99 (won't be able to for a few days), but I did have success with the SVN build ethereal-1.1.0-SVN-18184 (I think - fits the right timeframe on the 18th). However, the bug's pretty replicable; if I'm too slow validating, you could run the equivalent of 'tethereal -b filesize:50 -w pcap_test' and see if it properly rotates file sizes. I will test by EOW.
I validated both that it was failing before the patch and that it worked with the new source files in the above-linked checkin.
Thanks, worked for me too. Patches in 0.99.0-r1.
