Look at the tshark options for capture stop & output, similar to tcpdump, but not quite the same:
You're probably looking for the |
I am not sure I understand the question properly, but if I did: Please always remember to use -? or --help, according to "tshark -?" output:
-b duration:600 files 7 will give you a 70 minute ring buffer (rotation). If this is not what you meant, please clarify your question. |
will give you a rotating set of 20 files each of which will be (if my math is correct) 10 mb in size. The same thing can be accomplished using -b in place of the -a. [Up to this point I have found no difference between the two.] |