This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark display increasing trace file

0

I have a trace file which is keep growing till trace stops. My requirement is to display the growing trace file in Wireshrk so that user can get the real time packet capturing experience. I have Wireshark Version 1.6.0rc2. How can I achieve this using command line parameters? Please suggest.

asked 07 Nov '12, 20:17

manojdeoli's gravatar image

manojdeoli
1556
accept rate: 0%

edited 07 Nov '12, 20:18


2 Answers:

0

By default, Wireshark updates the packet list while capturing in GUI mode. The following options will change that behaviour:

Edit -> Preferences -> Capture -> Update list of packets in real time
Edit -> Preferences -> Capture -> Automatic scrolling in live capture
Edit -> Preferences -> Capture -> Hide capture info dialog

Please try them to see the difference. You can set these option on the commandline

wireshark -o capture.real_time_update:FALSE -o capture.auto_scroll:TRUE -o capture.show_info:FALSE

TRUE enables the option and FLASE disables the option.

If you capture at the commandline (with tshark), tshark will show the packets as well and if you use option -w (write capture file) it will count the packets and show that counter.

If your Wireshark version does not work like this, I recommend to use the latest released version 1.8.3.

If I misunderstood your question, please add some details.

Regards
Kurt

answered 08 Nov '12, 00:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

0

I think you're saying that some other process is creating the capture file and you want Wireshark to read from that file like it was a live capture; is that correct?

In that case: Wireshark doesn't do that yet. There is a bug request asking for the functionality: bug 5982 but it hasn't been implemented yet.

Also: 1.6.0rc2 is a Release Candidate for 1.6.0. 1.6.0 (the official release) has long since been released and the current 1.6 version is 1.6.11...

answered 08 Nov '12, 06:01

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%