This is our old Q&A Site. Please post any new questions and answers at

I'm using tshark (Windows version) in a script that I would like to run for an indefinite period of time. The tshark parameters are something like -i1 -s48 -x<filter>. This results in text to stdout that I process with gawk. However, a wiresharkXXXX temp file is also created. There doesn't seem to be a need for a temp file when the start parameters do not specify any file creation. It looks like the temp file will grow as long as my script runs, so eventually my HD will fill up, and the script will fail. Is there a solution?

asked 23 Sep '11, 09:37

faceoff's gravatar image

accept rate: 0%

edited 24 Sep '11, 15:24

helloworld's gravatar image


Actually: tshark runs dumpcap as a separate process to do the actual capture and the temp file is the method by which data to transferred to tshark.

I think using the tshark -b option to control the output file(s) will work.

Something like -b duration:... -b files:...

See tshark -h or the tshark man apge.

It's possible you may also need to use -w. I haven't actually tried this so I can't guarantee that this approach will work.

permanent link

answered 23 Sep '11, 12:44

Bill%20Meier's gravatar image

Bill Meier ♦♦
accept rate: 17%

Be aware of the following:

  • dumpcap is the process that does the actual capture
  • the temporary capture file is used between dumpcap and tshark
  • tshark has the -b command line option to use a circular buffer
  • tshark builds up state, increasing memory footprint over time, leading to out of memory problems
permanent link

answered 23 Sep '11, 13:00

Jaap's gravatar image

Jaap ♦
accept rate: 14%

I think the resolution to this problem will come when someone takes the time to resolve bug 2743.

permanent link

answered 23 Sep '11, 13:03

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 23 Sep '11, 09:37

question was seen: 4,636 times

last updated: 24 Sep '11, 15:24

p​o​w​e​r​e​d by O​S​Q​A