This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am creating an automatic routine to save pcap file. I'm having trouble saving the file with the date. Can someone help me?

C:\Program Files\Wireshark>Tshark -i rpcap://[172.16.254.6]/\Device\NPF_{CF9CFF4
6-79FF-4A97-802A-F6CEF5896D29} -f "tcp[20:4]=0x383D4649 and tcp[24:1]=0x58" -w C:\
APP01%date:~4,2%%date:~7,2%%date%~10,4%.pcap
tshark: A capture filter was specified both with "-f" and with additional comman
d-line arguments.

asked 26 Jun, 18:09

JorgeMiguelr210's gravatar image

JorgeMiguelr210
6446
accept rate: 0%


Those date commands appear to generate a file name with spaces in it. In that case you're going to need to quote the file name so that it's passed to tshark as a single argument (rather than 2 or more). For example:

C:\Program Files\Wireshark>Tshark -i rpcap://[172.16.254.6]/\Device\NPF_{CF9CFF46-79FF-4A97-802A-F6CEF5896D29} -f "tcp[20:4]=0x383D4649 and tcp[24:1]=0x58" -w "C:\APP01%date:~4,2%%date:~7,2%%date%~10,4%.pcap"

At least that's what would be necessary on Unix/Linux (which I'm far more familiar with...).

permanent link

answered 27 Jun, 06:44

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

You have a 1-character typo, namely the percent (%) after the last date should be a colon (:), i.e. you need to change this:

C:\Program Files\Wireshark>Tshark -i rpcap://[172.16.254.6]/\Device\NPF_{CF9CFF46-79FF-4A97-802A-F6CEF5896D29} -f "tcp[20:4]=0x383D4649 and tcp[24:1]=0x58" -w C:\APP01%date:~4,2%%date:~7,2%%date%~10,4%.pcap

to this:

C:\Program Files\Wireshark>Tshark -i rpcap://[172.16.254.6]/\Device\NPF_{CF9CFF46-79FF-4A97-802A-F6CEF5896D29} -f "tcp[20:4]=0x383D4649 and tcp[24:1]=0x58" -w C:\APP01%date:~4,2%%date:~7,2%%date:~10,4%.pcap
permanent link

answered 27 Jun, 20:49

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832

question asked: 26 Jun, 18:09

question was seen: 349 times

last updated: 27 Jun, 20:49

p​o​w​e​r​e​d by O​S​Q​A