Packet Buffer

Capsa captures traffic on the network and stores the analyzed packets into the buffer. All packets displayed on the Packet view are stored in the Packet Buffer. Therefore, the buffer size decides how many packets you can see on the Packet view.

Enable packet buffer

Packet buffer is enabled to store packet information. If this function is disabled, all statistical information based on packet will not be available, including detailed packet decoding information on the Packet view, the statistics on the Packet tab, the Data Flow tab, the Time sequence tab on the TCP Conversation view, the Packet window and the TCP Flow Analysis window.

Buffer size

By default the packet buffer size is set to be 16 MB. You can change the value, but you should take the size of your system memory into consideration.

You are recommended to set the packet buffer size to be less than half of the available physical memory of the operating system.

When buffer is full

When the Packet Buffer is full with captured packets, you can choose to:

• Discard oldest packets (circulative buffer)
  It is recommended to discard the oldest packets to store the latest packets.
• Discard new packets after analyzing
  All new captured packets will be discarded after being analyzed and will not be saved to the packet buffer.
• Discard all old packets
  The program will empty the packet buffer and then store new packets to it.
• Stop capture or replay
  Stop the current capture or replay.

If you do not want to miss any packets during the capture, read Packet Output to learn how to save all packets.