Hi! I'm using tshark for capturing probe requests for some statistic calculates on raspberry pi. Device has so small memory card and after ~20hours tshark overflow the memory.
I found only way to restart tshark every 1 hour for example.
I no need to create tmp file. I start the tshark by 'spawn' method using NodeJS and capturing stdout of it in nodejs process for sending to backend.
here is the command which runs tshark with needed filters and fields:
When tshark runs it will create the file in /tmp/wireshark_pcapng_wlan1_* .
How I can run it without creating this temp file? tshark version - 1.12.1.
asked 02 Apr '16, 08:09
The problem was solved! Here is the solution.
Firstly we cannot control output file using display filters. I need to capture probe requests only. I read that I can use for it pcap-filter and then I can control of output file and him size.
http://www.tcpdump.org/manpages/pcap-filter.7.html here I read about pcap-filter and syntax of it and change my tshark launch command to this:
And file cannot has more than 2 kb size.
answered 02 Apr '16, 15:56
Please read this article https://blog.packet-foo.com/2014/07/wireshark-file-storage/
answered 02 Apr '16, 08:34