This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

newbie question, need to run as a commald line

0

Hi

need to run Wireshark from a command line as follows if possible capture all packets with following options 1. IP name resolution 2. file capture directory c:capture 3. file size 100mb 4. 5 rolling files so when 5th one full goes back to number 1

thanks Steve

asked 06 Dec '10, 04:39

steve_1's gravatar image

steve_1
1111
accept rate: 0%


2 Answers:

0

Steve

tshark is installed as part of wirehark and should perform what is needed.

tshark -h prints the help

I think this is pretty close to what you need.. (you need to check the available interfaces via the tshark -D command)

tshark -f "port 53" -i 2 -b filesize:100 -b files:5 -w "c:capturedns-capture"

Eric

answered 06 Dec '10, 08:48

erics's gravatar image

erics
462
accept rate: 0%

0

If you want to run Wireshark with certain options see this part of the Users's Guide. If you just want to capture (not dissect straight away) then go for dumpcap.

answered 10 Dec '10, 04:12

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%