Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 2275] "Finished writing file" notification in ring-buffer mode.

[bugzilla-daemon@xxxxxxxxxxxxx]

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2275





--- Comment #2 from Bill Meier <wmeier@xxxxxxxxxxx>  2008-02-18 12:49:20 GMT ---
If you just need to capture packets for later analysis elsewhere:

How about using dumpcap directly to make the captures ??
(Dumpcap is the program used by tshark which actually does the captures).

Dumpcap when used in ringbuffer mode outputs the filename to stderr each time a
new file is opened (as well as outputting a 'packets' running total).

Using dumpcap also has the advantage of not needing to run the relatively
heavyweight tshark program just to do captures to a file.

See dumpcap -h

Example:
$dumpcap -i 1 -w foo.pcap -b duration:15
File: foo_00001_20080218074144.pcap
Packets: 0 File: foo_00002_20080218074200.pcap
Packets: 4 File: foo_00003_20080218074216.pcap
Packets: 8 Packets dropped: 0
$


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.