This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

On a Windows XP system dumpcap keeps creating new files even though "files:3" is used. What is wrong with my syntax?

C:\Temp>dumpcap.exe -i1 -b files:3 -b filesize:1 -w test.pcap
File: test_00001_20101207114220.pcap
Packets: 10 File: test_00002_20101207114223.pcap
Packets: 20 File: test_00003_20101207114227.pcap
Packets: 29 File: test_00004_20101207114228.pcap
Used CTL-C to quit

asked 07 Dec '10, 08:48

Gary's gravatar image

Gary
1333
accept rate: 0%

edited 07 Dec '10, 09:02

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245


When you use "-b files:3" dumpcap will create a ringbuffer of 3 files. This means it will keep creating new files forever, but it will only keep the latest three, all others will be deleted on the fly.

If you want to make dumpcap stop after 3 files, you will have to use the "-a" options. So your command would be:

C:Temp>dumpcap.exe -i1 -a files:3 -a filesize:1 -w test.pcap

(please notice that you can't mix -a and -b options, so you have to change both).

BTW this behavior is not Windows specific, dumpcap does the same thing on other platforms.

permanent link

answered 07 Dec '10, 09:00

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×89
×26

question asked: 07 Dec '10, 08:48

question was seen: 7,314 times

last updated: 07 Dec '10, 09:02

p​o​w​e​r​e​d by O​S​Q​A