Wireshark · Wireshark-users: Re: [Wireshark-users] Stop criteria using capture or display filters

[Christopher Maynard <Christopher.Maynard@xxxxxxxxx>]

Senthil Kumar S <senthilkumar.s@...> writes:

> I have an automation requirement, that needs tshark to be stoped upon meeting
certain condition.
>  
> From the tshark man pages, I found that stopping condition can be applied with
rrespect to duration, files, file size and multiple files mode.
>  
> Is there any stopping condition I can apply through capture filter so that
tshark stops capturing.
>  
> ex: Upon receiving a TCP SYN packet (condition applied in capture filter),
tshark stops capturing.
>  
> Please let me know any option like this is available.

This functionality is not yet available, although it has been requested and is
being tracked in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2039.  You
might want to add yourself to the "CC List" for the bug, and then you will be
automatically notified of any activity surrounding it.

- Chris