use tshark to write output to .log file for realtime review

Question

Folks, I am trying to leverage tshark to write output in plain text to a log file (.log), so I can review with a log viewer from another machine. My wireshark machine does not have a GUI, which is no big deal since I can use tshark.

I have already learned how to limit pcap output by time and filesize, but I need something that will write until stopped. I need the default data that is shown in a normal GUI dump, but I need to track via the .log file for a extended period of time.

Thanks.

Answer 1

Although I don't recommend doing this for long captures (it's inefficient and you'll quickly run out of disk space in this case), you can use the -V flag with file redirection:

tshark {options} -V > text.log

A more suitable alternative (esp for long captures) is to use dumpcap to capture to a pcap file, and then later use tshark to view the pcap (and you can still redirect tshark's output to a log file as indicated above).