Lets say if i want to capture the wireshark capture GUI column data live to a windows txt file using tshark. The tshark command will be like this :
asked 24 Apr '12, 18:38
edited 30 Apr '12, 07:10
You're assuming that the
Dissected packet information is written to the standard output, which is not necessarily being written to a file; even if it happens to be written to a file, TShark has no control over the file - it just gets its standard output redirected to a file by the program that runs it - probably
You would have to pipe the output of TShark to another program; that program could, for example, be given an argument specifying the path to the directory into which to write the files and part of the name to be given to the files, and could read its standard input and write it to a file and, when that file reaches its maximum size, close that file, open a new file, and continue writing its standard input to the new file. I don't know whether any such programs already exist, either for UN*X or Windows; if not, you might have to write it.
answered 25 Apr '12, 12:16
Guy Harris ♦♦
to hand over the capture files you will have to implement a "directory watcher" in java, that fires every time a new file is created in your working directory. tshark itself will not tell your external java programm when it creates a new "rolling" capture file. You can find some information about a "directory watcher" in java here:
I think you will get further information in a java programmer forum.
BTW: Why not using a libpcap wrapper in java altogether, instead of tshark?
answered 30 Apr '12, 09:18
Kurt Knochner ♦