This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi

need to run Wireshark from a command line as follows if possible capture all packets with following options 1. IP name resolution 2. file capture directory c:capture 3. file size 100mb 4. 5 rolling files so when 5th one full goes back to number 1

thanks Steve

asked 06 Dec '10, 04:39

steve_1's gravatar image

steve_1
1111
accept rate: 0%


Steve

tshark is installed as part of wirehark and should perform what is needed.

tshark -h prints the help

I think this is pretty close to what you need.. (you need to check the available interfaces via the tshark -D command)

tshark -f "port 53" -i 2 -b filesize:100 -b files:5 -w "c:capturedns-capture"

Eric

permanent link

answered 06 Dec '10, 08:48

erics's gravatar image

erics
462
accept rate: 0%

If you want to run Wireshark with certain options see this part of the Users's Guide. If you just want to capture (not dissect straight away) then go for dumpcap.

permanent link

answered 10 Dec '10, 04:12

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×23
×16

question asked: 06 Dec '10, 04:39

question was seen: 2,434 times

last updated: 10 Dec '10, 04:12

p​o​w​e​r​e​d by O​S​Q​A