This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark wiresharkXXXX file even with text to stdout

I'm using tshark (Windows version) in a script that I would like to run for an indefinite period of time. The tshark parameters are something like -i1 -s48 -x<filter>. This results in text to stdout that I process with gawk. However, a wiresharkXXXX temp file is also created. There doesn't seem to be a need for a temp file when the start parameters do not specify any file creation. It looks like the temp file will grow as long as my script runs, so eventually my HD will fill up, and the script will fail. Is there a solution?

tshark script

asked 23 Sep '11, 09:37

faceoff
1●1●1●1
accept rate: 0%

edited 24 Sep '11, 15:24

helloworld
3.1k●4●20●41

3 Answers:

Actually: tshark runs dumpcap as a separate process to do the actual capture and the temp file is the method by which data to transferred to tshark.

I think using the tshark -b option to control the output file(s) will work.

Something like -b duration:... -b files:...

See tshark -h or the tshark man apge.

It's possible you may also need to use -w. I haven't actually tried this so I can't guarantee that this approach will work.

answered 23 Sep '11, 12:44

Bill Meier ♦♦
3.2k●1●8●50
accept rate: 17%

Be aware of the following:

dumpcap is the process that does the actual capture
the temporary capture file is used between dumpcap and tshark
tshark has the -b command line option to use a circular buffer
tshark builds up state, increasing memory footprint over time, leading to out of memory problems

answered 23 Sep '11, 13:00

Jaap ♦
11.7k●16●101
accept rate: 14%

0	I think the resolution to this problem will come when someone takes the time to resolve bug 2743. answered 23 Sep '11, 13:03 cmaynard ♦♦ 9.4k●10●38●142 accept rate: 20%