# tshark script to capture for 5 minutes?

 0 Hi All, are there any sample scripts to initiate tshark, run it for 5 minutes, initiate a few commands like ping 8.8.8.8, http://www.google.com, tracert www.msn.com, etc. and then close tshark and save the file to a local directory so it can be analyzed later? Thanks! asked 07 Jun '16, 08:26 Gipper2016 11●1●1●3 accept rate: 0%

 1 Sure there are but as you haven't given the operating system, we have to guess by the name of tracert that you have in mind Windows. And what you ask is rather a question on scripting than on Wireshark. So by looking at tshark man page, you'd find that tshark -a duration:300 ... will limit tshark's run to 300 seconds = 5 minutes. The magic command you need to spawn a parallel process in Windows is "start" and it requires a window title as the first parameter. So you'd use start "my tshark window" "your\full\path\to\tshark\tshark.exe" -a duration:300 -w your\destination\file.pcap ... (put your capture options instead of the dots) as the first line of your .bat file, and on the next lines, you'd run the ping, tracert etc. To see the http, use start as well: start "meaningless" "your\full\path\to\the\browser\browser.exe" http://www.google.com. ` answered 07 Jun '16, 09:41 sindy 6.0k●4●8●51 accept rate: 24% Thank you sindy, excellent info! Another hurdle I see is how to select an active interface? Is it best to just select all interfaces? or is there a trick to pick only active interfaces? Thanks! (07 Jun '16, 11:43) Gipper2016 I'm not sure I understand what you mean. You seem to be going to ping, traceroute and browse known addresses, so the routing table should give you enough information to know in advance which interface the OS will use to send those packets. But capturing on all interfaces won't do any harm, as the capture file contains the ID of the interface on which each particular frame has been captured, so you can work with that information later. (07 Jun '16, 22:20) sindy Sorry, wasn't clear. Since laptops will have multiple interfaces and by default tshark will pick the first non loopback, is there a way to prompt the user to select an interface or is it possible to silently select all interfaces programmatically? I'm trying to automate the process as much as possible for someone that does not know how to use wireshark so they can run it remotely and send me the output file. (08 Jun '16, 13:18) Gipper2016 See the manual, use -i to define the interface. Prompting can be done via your script, if needed. (08 Jun '16, 22:26) Jaap ♦
 toggle preview community wiki:

By Email:

Markdown Basics

• *italic* or _italic_
• **bold** or __bold__
• image?![alt text](/path/img.jpg "title")
• numbered list: 1. Foo 2. Bar
• to add a line break simply add two spaces to where you would like the new line to be.
• basic HTML tags are also supported

Question tags:

×832
×31
×8

question asked: 07 Jun '16, 08:26

question was seen: 4,012 times

last updated: 08 Jun '16, 22:26

### Related questions

p​o​w​e​r​e​d by O​S​Q​A