This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to hide the count of captured packets with tshark

0

Hi, I would like to know how I could hide the count of the packets that tshark captured. I tried the options -q and -Q but it display only the count wheras I would like to display only the packets. I read the doc, but I didn't find how to do this. Can somebody help me ?

Thank you.

asked 04 Feb '14, 04:34

Olivier07's gravatar image

Olivier07
1112
accept rate: 0%

edited 04 Feb '14, 07:23

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237


One Answer:

3

Please try the following:

Bourne shell and compatible shells (ksh, bash, etc.) on Unix-compatible systems:

tshark -ni 1 -w output.pcap > /dev/null 2>&1

C shell and compatible shells (tcsh, etc.) on Unix-compatible systems:

tshark -ni 1 -w output.pcap >& /dev/null

Windows:

tshark -ni 1 -w output.pcap 2> NUL > NUL

actually, the same syntax (2>&1) works for Windows.

tshark -ni 1 -w output.pcap > NUL 2>&1

Both will redirect STDOUT and STDERR (descriptor 2) to the NUL(L) device.

Regards
Kurt

answered 04 Feb '14, 06:15

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 04 Feb '14, 18:00

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

Thank you for your answer, it works fine !

(04 Feb '14, 07:15) Olivier07

Good.

BTW: Please don't mark the title of a question with [RESOLVED].

If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).

See the FAQ for some information how this site works. Thank you!

(04 Feb '14, 07:23) Kurt Knochner ♦

Doesn't work for me. tshark -ni eth0 -w output.pcap > /dev/null 2>&1

(01 Sep '14, 07:45) insekt

What's your shell? You can check it by echo $SHELL

It works for me:

host:~ edmond$ sudo tshark -ni en1 -w output.pcap > /dev/null 2>&1 Password: ^Chost:~ edmond$ ls -l output.pcap -rw------- 1 root staff 1768 Sep 2 01:07 output.pcap host:~ edmond$

(01 Sep '14, 16:06) Edmond