Tip of the Month

Network Analysis Tip of the Month – April 2005

Smart(er) Capturing

When you start capturing packets on a high utilization network with the default configuration in capture options you will notice that the buffer sizes are limited to 16 MB only filling up the capture real quick. You can increase the default buffer size (displayed in kilobytes) from the capture options dialogue while keeping in mind two important things:

1. The capture buffer controls the size of your packet capture and what is actually displayed to you in the packets tab
2. The file size option in the “Save to disk” section controls the size of the file when you decide to save the packets to the hard disk for analysis at a later date.

The above-mentioned buffer options and file sizes, however different, are related to each other. WildPackets’ products users must understand that the size of the file being saved to the disk will be limited by the capture buffer size. For example, if your capture buffer is set to 100,000 kilobytes and your “Save to disk” file size is set to 150 MB; you will be able to save 100 megabytes worth of packets only. To save the desired 150 MB sized file, you would have to increase your buffer size to match that as well.

Here are a few other tips to keep in mind while capturing and saving packets:

1. WildPackets products currently support maximum buffer size and file size of 1 GB
2. File sizes larger than 512 MB are usually not recommended for any application for performance reasons. They take longer to read, store, transfer and archive. (How many 1 GB or grater word documents do you create or use often?)
3. Do not make file sizes so large that they are harder to read on analyzers with lower machine resources such as 512 MB or only 256 MB RAM