Wireshark · Wireshark-users: [Wireshark-users] dumpcap -c caveat [Re: Can I get Wireshark to capture constantly, but not count to

[Gregorio Tomas Focaccio <public.focaccio@xxxxxxxxx>]

Be aware that the -c argument appears to be absolute and overrides any of the ring buffer arguments.  My command: dumpcap -b duration:1800 files:5 -i 4 -c 5000 -w 915PBLbr0 stopped at 5000 packets and did not start writing to the next file.  My new, and hopefully final command for capturing all packet seen by the 4th interface of dumpcap -D list to a ring-buffer of 5 files with a capture duration of 30 minutes each is:  dumpcap -b duration:1800 files:5 -i 4 -w 915PBLbr0