Multiple Files preference "Create new file automatically...after" [time] working incorrectly

Jim Aragon said:

Created attachment 17944

Screenshot after making initial settings and before starting the packet capture.

Build Information:

Version 3.2.6 (v3.2.6-0-g4f9257fb)

Copyright 1998-2020 Gerald Combs <gerald@‍wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.12.8, with WinPcap SDK (WpdPack) 4.1.2, with GLib 2.52.3, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #‍11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled resampler), with SBC, with SpanDSP, with bcg729.

Running on 64-bit Windows 10 (2004), build 19041, with Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz (with SSE4.2), with 16300 MB of physical memory, with locale English_United States.1252, with light display mode, without HiDPI, with Npcap version 0.9995, based on libpcap version 1.9.1, with GnuTLS 3.6.3, with Gcrypt 1.8.3, with brotli 1.0.2, without AirPcap, binary plugins supported (19 loaded). Built using Microsoft Visual Studio 2019 (VC++ 14.27, build 29111).

When using multiple files and capturing to a file set, the preference "Start a new file automatically...after [time period]" works as if you selected "Start a new file automatically...when time is a multiple of [time period]."

To REPRODUCE

Go to Capture Options > Output.
Specify a path and base filename in the filename input box.
Check "Create a new file automatically..."
Check the third preference down, "after," and set the time field to 30 seconds.
Leave "when time is a multiple of" unchecked, and leave the time period at the default value of 1 hour. See the first attachment: "Screenshot Before Capture.jpg"
Open a real time clock display on your computer. Click "Start" when the time is at xx:xx:50 (ten seconds before the next minute). Wireshark will start capturing. It will close the first file and open the second file after approximately 10 seconds, and then it will start a new file every 30 seconds thereafter.
Stop the capture and go back to Capture Options > Output. The selected preference "after [time period]" will now be unchecked and the fourth preference "when time is a multiple of [time period]" will now be checked and the value in the time period field will now be 30 seconds, the value that was, and still is, in the time period field for the third preference. See the second attachment: "Screenshot After Capture.jpg." However, if you now click the Start button or the Close button, Wireshark will display this error "Multiple files: No file limit given. You must specify a file size, interval, or number of packets for each file."

added clidumpcap oswindows version3.2 labels

Jim Aragon said:

Created attachment 17945 Screenshot after capturing

Jaap Keuter said:

Can you test with tshark as well? This would give an better idea if this issue is with the parameter handling, or the Qt UI. Either way I doubt this is dumpcap which has an issue.

Jim Aragon said:

(In reply to Jaap Keuter from comment #2)

Can you test with tshark as well? This would give an better idea if this issue is with the parameter handling, or the Qt UI. Either way I doubt this is dumpcap which has an issue.

I tested with tshark using the following command:

tshark -i 7 -w Bugzilla.pcapng -b duration:60

...where "7" is the interface index number of the active wireless adapter on the laptop I was using for testing. I executed the command at time xx:xx:50 (10 seconds before the next even minute) several times. The problem did NOT occur, and each time, tshark wrote the file--including the first one--for a full 60 seconds before rolling over to the next file.

Feel free to change the component from Dumpcap to whatever you think is more appropriate. I really wasn't sure what to pick.

Crosslinking to Ask question:
Capture Options Output After Time vs Time is Multiple of does not appear to work as expected

Merge Request (coming soon) will close this one also:
Capture stop time automatically changes

mentioned in merge request !5131 (merged)

closed with merge request !5131 (merged)

closed with commit c560226f

mentioned in commit 710b90a5

mentioned in merge request !7207 (merged)

mentioned in commit 9f5f947a

mentioned in merge request !7208 (merged)

Multiple Files preference "Create new file automatically...after" [time] working incorrectly

Child items 0

Activity