This is a static archive of our old Q&A Site. Please post any new questions and answers at

How to hide the count of captured packets with tshark


Hi, I would like to know how I could hide the count of the packets that tshark captured. I tried the options -q and -Q but it display only the count wheras I would like to display only the packets. I read the doc, but I didn't find how to do this. Can somebody help me ?

Thank you.

asked 04 Feb '14, 04:34

Olivier07's gravatar image

accept rate: 0%

edited 04 Feb '14, 07:23

Kurt%20Knochner's gravatar image

Kurt Knochner ♦

One Answer:


Please try the following:

Bourne shell and compatible shells (ksh, bash, etc.) on Unix-compatible systems:

tshark -ni 1 -w output.pcap > /dev/null 2>&1

C shell and compatible shells (tcsh, etc.) on Unix-compatible systems:

tshark -ni 1 -w output.pcap >& /dev/null


tshark -ni 1 -w output.pcap 2> NUL > NUL

actually, the same syntax (2>&1) works for Windows.

tshark -ni 1 -w output.pcap > NUL 2>&1

Both will redirect STDOUT and STDERR (descriptor 2) to the NUL(L) device.


answered 04 Feb '14, 06:15

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 04 Feb '14, 18:00

Guy%20Harris's gravatar image

Guy Harris ♦♦

Thank you for your answer, it works fine !

(04 Feb '14, 07:15) Olivier07


BTW: Please don't mark the title of a question with [RESOLVED].

If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).

See the FAQ for some information how this site works. Thank you!

(04 Feb '14, 07:23) Kurt Knochner ♦

Doesn't work for me. tshark -ni eth0 -w output.pcap > /dev/null 2>&1

(01 Sep '14, 07:45) insekt

What's your shell? You can check it by echo $SHELL

It works for me:

host:~ edmond$ sudo tshark -ni en1 -w output.pcap > /dev/null 2>&1 Password: ^Chost:~ edmond$ ls -l output.pcap -rw------- 1 root staff 1768 Sep 2 01:07 output.pcap host:~ edmond$

(01 Sep '14, 16:06) Edmond