This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When I use the link below to automatically start wireshark when starting the PC, wireshark will not create a new log file each time the computer is restarted:

"C:\Program Files (x86)\Wireshark\wireshark.exe" -i "\Device\NPF_{59A6CEB4-F94B-47ED-A6FF-7F61ED6EED06}" -k -w "C:\Users\receptie1\Desktop\SHARE\capture.pcap" -B10 -b:5000

Please provide me a solution. Thank you.

asked 13 Jan '13, 21:12

Ruben's gravatar image

Ruben
1111
accept rate: 0%


You can use the following command in your batch script, to add the current date/time to the file name:

set filename=C:\Users\receptie1\Desktop\SHARE\capture-%date%-%time:~0,2%-%time:~3,2%-%time:~6,2%.pcap

Then use the variable filename with the option -w

wireshark -w %filename%

Sample:

C:>set filename=C:\Users\receptie1\Desktop\SHARE\capture-%date%-%time:~0,2%-%time:~3,2%-%time:~6,2%.pcap

C:>echo %filename% C:\Users\receptie1\Desktop\SHARE\capture-14.01.2013-10-19-01.pcap

Regards
Kurt

permanent link

answered 14 Jan '13, 01:21

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 14 Jan '13, 02:01

There is a syntax error in your command, which prevents the command from being run:

"C:\Program Files (x86)\Wireshark\wireshark.exe" -i "\Device\NPF_{59A6CEB4-F94B-47ED-A6FF-7F61ED6EED06}" -k 
    -w "C:\Users\receptie1\Desktop\SHARE\capture.pcap" -B10 -b:5000

The "-b" option expects some more info (see "wireshark -h" output):

  -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
                           filesize:NUM - switch to next file after NUM KB
                           files:NUM - ringbuffer: replace after NUM files

So you could use the following command:

"C:\Program Files (x86)\Wireshark\wireshark.exe" -i "\Device\NPF_{59A6CEB4-F94B-47ED-A6FF-7F61ED6EED06}" -k 
    -w "C:\Users\receptie1\Desktop\SHARE\capture.pcap" -B10 -b filesize:5000 -b files:100

To create a ringbuffer of 100 files of 5000KB each (500 MB in total). When wireshark needs to create the 101st file, it will delete the oldest file first. Please be aware that old files are not removed after each restart, so each restart will add another 100 files of 5000KB. You need to remove the files yourself after a reboot.

permanent link

answered 14 Jan '13, 15:08

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×8
×7
×4
×2

question asked: 13 Jan '13, 21:12

question was seen: 2,008 times

last updated: 14 Jan '13, 15:08

p​o​w​e​r​e​d by O​S​Q​A