Wireshark · Wireshark-users: [Wireshark-users] How can I run tshark for days at a time without running out of disk space?

[Marc MERLIN <marc_ws@xxxxxxxxxxx>]

Howdy,

I'm currently running tshark like this:
tshark -n -V -l -i eth1 port nfs and host 172.28.80.41 | myscript

I need this to run for days and days.

Tshark however seems to capture to /tmp/etherXXXXjRZvbB with dumpcap and
have an every growing file until I run out of space (file that tshark reads
and parses).

Can I either:
1) skip dumpcap and not have an ever growing file?
2) tell tshark to quit when the dumpcap file is 10G and I'll restart it in 
   a loop after /bin/rm /tmp/etherXXX*

Or any other suggestion so that tshark doesn't eat all my disk space?
(I read about -a capture autostop, but that seems to be if I capture to a file
and I don't want to capture to a file, I just want pipes and real time
processing)

Thanks,
Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/