...
When the volume reaches the threshold value (depending on the configuration of the QP), the oldest PCAP and compressed PCAP are deleted to make room for the newest PCAP captures.
...
Regarding Rotation: By default, the threshold is set at 5%. The rotation mechanism becomes operational as soon as the capacity reaches 95%. This process involves the removal of the oldest files until the capacity returns to 95%. However, please note that the rotation process cannot be applied to the /cifs/capture/permanent directory. This particular directory is exempt from rotation, as the files within it can only be deleted intentionally by a user who wishes to remove them.
Optimal Conditions for Rotation:
For 1Gbps sustained capturing, it will be good to have at least 5 minutes worth of buffer space.
So 1Gbps x 300 seconds = 300GB -> 300Gb/(8bit/byte) = 37.5GB
(Optimal Volume Capacity) x 5% = 37.5GB
(Optimal Volume Capacity) = 750GB
For 10Gbps sustained capturing:
10Gbps x 300 seconds = 3Tb -> 3Tb/(8bit/byte) = 375GB
(Optimal Volume Capacity) x 5% = 375GB
(Optimal Volume Capacity) = 7.5TB
OoS Detect
After starting capturing with OoS-Detect (Out-of-Sync Detection) enabled, the Capture Preview section of the Capture Panel will display alerts in an event that it detects any possible Out-of-Sync packet. Mostly used for multicast traffic.
...