This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm using tshark (Windows version) in a script that I would like to run for an indefinite period of time. The tshark parameters are something like -i1 -s48 -x<filter>. This results in text to stdout that I process with gawk. However, a wiresharkXXXX temp file is also created. There doesn't seem to be a need for a temp file when the start parameters do not specify any file creation. It looks like the temp file will grow as long as my script runs, so eventually my HD will fill up, and the script will fail. Is there a solution?

asked 23 Sep '11, 09:37

faceoff's gravatar image

faceoff
1111
accept rate: 0%

edited 24 Sep '11, 15:24

helloworld's gravatar image

helloworld
3.1k42041


Actually: tshark runs dumpcap as a separate process to do the actual capture and the temp file is the method by which data to transferred to tshark.

I think using the tshark -b option to control the output file(s) will work.

Something like -b duration:... -b files:...

See tshark -h or the tshark man apge.

It's possible you may also need to use -w. I haven't actually tried this so I can't guarantee that this approach will work.

permanent link

answered 23 Sep '11, 12:44

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%

Be aware of the following:

  • dumpcap is the process that does the actual capture
  • the temporary capture file is used between dumpcap and tshark
  • tshark has the -b command line option to use a circular buffer
  • tshark builds up state, increasing memory footprint over time, leading to out of memory problems
permanent link

answered 23 Sep '11, 13:00

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

I think the resolution to this problem will come when someone takes the time to resolve bug 2743.

permanent link

answered 23 Sep '11, 13:03

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×31

question asked: 23 Sep '11, 09:37

question was seen: 4,465 times

last updated: 24 Sep '11, 15:24

p​o​w​e​r​e​d by O​S​Q​A