This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a command to run tshark for a specific amount of time?

0

Is there a command to tell tshark to capture for, say, 15 minutes then stop?

asked 13 Sep '16, 01:21

elektrovert's gravatar image

elektrovert
21●4●4●8
accept rate: 0%

2 Answers:

3

If you want to have tshark capture for 15 minutes and then stop, you need to use the autostop "-a duration:900" option, not the ringbuffer "-b duration:900" option.

Refer to the tshark man page or tshark section of the user guide for more information on this and other tshark options.

answered 13 Sep '16, 07:19

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Right, my bad... I was too quick with this...

(13 Sep '16, 07:22) Jasper ♦♦

Thanks! I'll try this

(13 Sep '16, 23:30) elektrovert

0

yes, use the -b option with duration:NUM, where NUM is a number of seconds. In your case 15*60.

answered 13 Sep '16, 01:24

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

Many thanks!

(13 Sep '16, 01:24) elektrovert