Rolling packet data capture using tshark live.

Question

Lets say if i want to capture the wireshark capture GUI column data live to a windows txt file using tshark. The tshark command will be like this : tshark -i your_interface -n > your _path _to _text _file I would like to ROLL the windows txt file that conatins the wireshark capture GUI column data that is captured live. The windows batch file will then run the java files that process the txt file data that has just rolled (The packet data info had stopped appending to the same file) while more the packet data is captured to another txt file live. The whole process will repeat. My goal is to automate this whole process by writing a windows 7 batch file and run it on boot.(Placing the written batch file on the STARTUP folder so the batch file will execute). i tried this command on windows 7 CLI: tshark -i 3 -b filesize:1024 -b files:5 -n> "C:\\Users\\L33604\\Desktop\\Folder\\Capture.txt" The error message was thrown tshark : maximum capture file size specified, but capture isn't saved to a file. I know that this command would never run the java file that processes the txt file that has been just rolled. How would the above tshark command change and how would the batch file be written to execute the whole process i described?? Or any better recommendation? The main idea is

rolling captured packet data live using tshark command.
running java files that process the single txt file just rolled while live capturing is still going on to another txt file in a multitasking manner.
Once after the java file has finished executing its codes, wait for more packet data to be captured to the other txt file to its limit then run the same java files again.

Answer 1

You're assuming that the -b options apply when writing out dissected packet information in text form rather than when writing out raw binary packet data in pcap or pcap-ng form; they do not.

Dissected packet information is written to the standard output, which is not necessarily being written to a file; even if it happens to be written to a file, TShark has no control over the file - it just gets its standard output redirected to a file by the program that runs it - probably cmd.exe in your case.

You would have to pipe the output of TShark to another program; that program could, for example, be given an argument specifying the path to the directory into which to write the files and part of the name to be given to the files, and could read its standard input and write it to a file and, when that file reaches its maximum size, close that file, open a new file, and continue writing its standard input to the new file. I don't know whether any such programs already exist, either for UN*X or Windows; if not, you might have to write it.

Answer 2

to hand over the capture files you will have to implement a "directory watcher" in java, that fires every time a new file is created in your working directory. tshark itself will not tell your external java programm when it creates a new "rolling" capture file. You can find some information about a "directory watcher" in java here:

http://docs.oracle.com/javase/tutorial/essential/io/notification.html
http://java.dzone.com/news/how-watch-file-system-changes
http://www.venishjoe.net/2009/10/monitor-directory-for-changes-using.html

I think you will get further information in a java programmer forum.

BTW: Why not using a libpcap wrapper in java altogether, instead of tshark?

jNetPcap
http://jnetpcap.com/

Jpcap
http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/

Regards
Kurt