This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a command to tell tshark to capture for, say, 15 minutes then stop?

asked 13 Sep '16, 01:21

elektrovert's gravatar image

elektrovert
21448
accept rate: 0%


If you want to have tshark capture for 15 minutes and then stop, you need to use the autostop "-a duration:900" option, not the ringbuffer "-b duration:900" option.

Refer to the tshark man page or tshark section of the user guide for more information on this and other tshark options.

permanent link

answered 13 Sep '16, 07:19

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Right, my bad... I was too quick with this...

(13 Sep '16, 07:22) Jasper ♦♦

Thanks! I'll try this

(13 Sep '16, 23:30) elektrovert

yes, use the -b option with duration:NUM, where NUM is a number of seconds. In your case 15*60.

permanent link

answered 13 Sep '16, 01:24

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Many thanks!

(13 Sep '16, 01:24) elektrovert
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×20
×14

question asked: 13 Sep '16, 01:21

question was seen: 8,467 times

last updated: 13 Sep '16, 23:30

p​o​w​e​r​e​d by O​S​Q​A