Ring Buffer Capture
Definition
A capture mode in which the tool writes successive PCAP files of a fixed size or duration, overwriting the oldest when the buffer is full. Used for continuous monitoring where indefinite storage is not available. In forensic deployments, the ring buffer is typically frozen (stopped) the moment an incident is declared, to preserve the files covering the relevant window.
- Method
- Successive fixed-size or fixed-duration PCAP files
- Behaviour when full
- Overwrites the oldest file
- Use case
- Continuous monitoring with limited storage
- Incident response step
- Buffer frozen when an incident is declared
Common questions
Why is freezing the ring buffer immediately important during an incident?+
If capture continues after an incident is detected, the buffer's fixed-size rotation will eventually overwrite the very packets showing the intrusion or exfiltration, so responders must stop the capture as soon as possible to preserve the relevant window.
What determines how much history a ring buffer actually preserves?+
The total configured buffer size divided by the traffic volume rate determines the retention window, so a busy network fills and overwrites the buffer faster than a quiet one with the same storage allocation.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- Network Tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- PCAP / PCAPng
- The standard file formats for storing captured packets. PCAP (libpcap format) is the legacy standard supported by virtually all tools. PCAPng (Next...
- Promiscuous Mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...
- SPAN Port (Port Mirroring)
- A switch feature that copies frames from one or more source ports or VLANs to a designated destination port, where a capture...