Wireshark-users: [Wireshark-users] Compressed capture?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Darren Tay <gluino@xxxxxxxxx>
Date: Fri, 30 Apr 2010 12:17:00 +0800
Hi all, getting straight to the question...

I am relatively new, and am using tshark over SSH (on an outsourced datacenter box, CentOS/RH), and then transferring the .cap file over to a local box for review using the GUI. 
Specifically, I am giving:
  tshark port 25 -w capfile.cap

The documentation isn't very clear about compressed-mode capturing.
I am concerned because I need to capture quite a large volume of traffic in order to track down the problem I am looking for.
I am guessing anywhere in the region of about 500 Mbyte to 2 Gbyte, within 5 hours.

Will tshark work OK like this?
Do I need to explicitly tell it to write in compressed mode?

When capturing in compressed mode, is the compression done in a streaming fashion or is it applied just once when capturing has ended?

Thanks!