This is our old Q&A Site. Please post any new questions and answers at


need to run Wireshark from a command line as follows if possible capture all packets with following options 1. IP name resolution 2. file capture directory c:capture 3. file size 100mb 4. 5 rolling files so when 5th one full goes back to number 1

thanks Steve

asked 06 Dec '10, 04:39

steve_1's gravatar image

accept rate: 0%


tshark is installed as part of wirehark and should perform what is needed.

tshark -h prints the help

I think this is pretty close to what you need.. (you need to check the available interfaces via the tshark -D command)

tshark -f "port 53" -i 2 -b filesize:100 -b files:5 -w "c:capturedns-capture"


permanent link

answered 06 Dec '10, 08:48

erics's gravatar image

accept rate: 0%

If you want to run Wireshark with certain options see this part of the Users's Guide. If you just want to capture (not dissect straight away) then go for dumpcap.

permanent link

answered 10 Dec '10, 04:12

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 06 Dec '10, 04:39

question was seen: 2,606 times

last updated: 10 Dec '10, 04:12

p​o​w​e​r​e​d by O​S​Q​A