Hi, I was wondering if it's possible to chose the name of the output file of tshark. tshark automatically adds the timestamp to the name I give (e.g. "file"), but I would like to get rid of that and instead have just a number, like "file1", "file2", "file3", ... Is that possible? Thanks! asked 13 Jul '15, 02:34  pat_celine |
One Answer:
It is currently not possible to override the formatting of the file name. Either you have a static filename or you enable the "ringbuffer" mode. The exact (simple) format is defined source code of ringbuffer.c. If you need a customizable output filename, please open a feature request at https://bugzilla.wireshark.org/. answered 15 Jul '15, 13:00  Lekensteyn |
Can you provide the command? Default behavior of tshark output file names is not something like you said. Maybe you are using some extra options.
Hi! Something like tshark -i 2 -a files:10 -b duration:300 -w "analysis\file.pcap" This outputs file_00001_20150714102556 as the first file (the last part is the timestamp). I'd like to get just file_0001, for example Thanks!