rapid7/metasploit-framework — pull request #605 by mephos (2012-07-12 13:16:16+00:00)
Title: really limit packet count and data size in linux sniffer

without this patch, when specifying a packet limit (500 for instance), packet count captured and data bytes captured kept increasing above 500.
For instance, meterpreter reported to metasploit that he had captured 10000 packets worth 30 Mb whereas he had only stored 500 packets.

What isn't clear with packet count is what we want when we specify 500 for example :
- 500 packets from the moment we start (so the 500 first packets, so we could stop capturing packets and have a fixed "number of bytes captured")
- maximum 500 packets until we finish (so the 500 last packets, so the number of bytes captured will vary because we free old packets and store new ones that don't have the same size)

Currently, solution 2 is implemented.