Automate wireshark capture

I'm assuming you're on Windows (based on the path C:\Program Files\Wireshark). This isn't really a Wireshark question, it's a Windows command line question. The following works for me on Windows Vista:

tshark -i 1 -a duration:3600 -w C:\WiresharkCapture\test%date:~7,2%%date:~4,2%%date%~10,4%.pcap

This command was executed on September 12, 2012 and the filename was "test12092012.pcap".

This syntax is dependent on your locale and exactly how the date is displayed on your system, so you might have to tinker with it a bit. If this doesn't work for you, Google on "windows date filename" and you'll get dozens of results showing various commands for including the date in a file name from the command prompt. On my computer, the output of the 'date' command is displayed as "Wed 09/12/2012".

You could also use Wireshark's ring buffer option, but stop after a single file with something like this:

tshark -i 1 -a duration:3600 -b duration:3600 -w C:\WiresharkCapture\test.pcap

A ring buffer normally writes multiple files, but by setting the autostop (-a) option duration to the same value as the ring buffer (-b) option duration, tshark will only write one file, which is what your command above does. (However, an hour can be a long time to capture on a busy network, so you might want to consider using a ring buffer option that writes multiple files over the one-hour period.)

This will include the date and time in the filename, but will not give you any control over how the name is formatted. I ended up with a file named test_00001_20120912001856.pcap when I executed the command at 00:18:56 on September 12th, 2012.

hwo to capture all files captured? I do get only the last file which is being captured for exporting. I dont get all the files captured to export.