No new log file is created after restart PC

Question

When I use the link below to automatically start wireshark when starting the PC, wireshark will not create a new log file each time the computer is restarted:

"C:\Program Files (x86)\Wireshark\wireshark.exe" -i "\Device\NPF_{59A6CEB4-F94B-47ED-A6FF-7F61ED6EED06}" -k -w "C:\Users\receptie1\Desktop\SHARE\capture.pcap" -B10 -b:5000

Please provide me a solution. Thank you.

Answer 1

You can use the following command in your batch script, to add the current date/time to the file name:

set filename=C:\Users\receptie1\Desktop\SHARE\capture-%date%-%time:~0,2%-%time:~3,2%-%time:~6,2%.pcap

Then use the variable filename with the option -w

wireshark -w %filename%

Sample:

C:>set filename=C:\Users\receptie1\Desktop\SHARE\capture-%date%-%time:~0,2%-%time:~3,2%-%time:~6,2%.pcap

C:>echo %filename% C:\Users\receptie1\Desktop\SHARE\capture-14.01.2013-10-19-01.pcap

Regards
Kurt

Answer 2

There is a syntax error in your command, which prevents the command from being run:

"C:\Program Files (x86)\Wireshark\wireshark.exe" -i "\Device\NPF_{59A6CEB4-F94B-47ED-A6FF-7F61ED6EED06}" -k 
    -w "C:\Users\receptie1\Desktop\SHARE\capture.pcap" -B10 -b:5000

The "-b" option expects some more info (see "wireshark -h" output):

  -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
                           filesize:NUM - switch to next file after NUM KB
                           files:NUM - ringbuffer: replace after NUM files

So you could use the following command:

"C:\Program Files (x86)\Wireshark\wireshark.exe" -i "\Device\NPF_{59A6CEB4-F94B-47ED-A6FF-7F61ED6EED06}" -k 
    -w "C:\Users\receptie1\Desktop\SHARE\capture.pcap" -B10 -b filesize:5000 -b files:100

To create a ringbuffer of 100 files of 5000KB each (500 MB in total). When wireshark needs to create the 101st file, it will delete the oldest file first. Please be aware that old files are not removed after each restart, so each restart will add another 100 files of 5000KB. You need to remove the files yourself after a reboot.