Wireshark-users: Re: [Wireshark-users] temp files not cleaned up
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 18 Jan 2010 12:08:14 -0500
Jeff Liegel wrote:
 I am using the following statement regularly:

/usr/sbin/tshark -a duration:100 -i eth1 port 5060 or port 10000 or port 8080 > /var/tmp/RegPerMin.out

And there are the following files accumulating in the /tmp directory. Why does this happen and how can I stop it?

[]# ls /tmp
etherXXXX0DPJIF  etherXXXXBVxm3l  etherXXXXK11PGb  etherXXXXsFTnPK
etherXXXX0dXCCX  etherXXXXBwd1kc  etherXXXXK2Dvpe  etherXXXXSJusFj
etherXXXX0fJPh2  etherXXXXc3v3EB  etherXXXXK4maTr  etherXXXXSLzt54
etherXXXX0keWvI  etherXXXXc5f10F  etherXXXXk8t0iW  etherXXXXstROuY
etherXXXX0op4vp  etherXXXXCcF6C5  etherXXXXkhLZ3f  etherXXXXSvoqhL
etherXXXX0QbLIj  etherXXXXCS58cP  etherXXXXkLBcYh  etherXXXXT5qfBI

First, please compose a new email when starting a new thread/subject (instead of replying to another one on a different subject)--replying as you did messes up threaded mail readers.

Anyway, it appears that tshark won't delete the temporary file when using the autostop feature. I took a quick look and couldn't figure out why. I'd suggest you open a bug so this doesn't get lost: http://bugs.wireshark.org