This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark auto shutdown

0

Hi folks;

I am automating some tests that use wireshark. I will switching to tshark so the tests can be batched.

Each test will perform a capture, perhaps with a unique capture filter. How do I "terminate" the tshark process once I've captured 1000 packets (just an example), so that I can create a new tshark process for my next test ?? If a set a capture filter to "stop capturing" after 1000 packets, will that terminate the tshark process automagically ??

thanks wk

asked 17 Feb '12, 08:23

wakelt's gravatar image

wakelt
13101013
accept rate: 0%


One Answer:

2

Yes.

e.g. use -c 1000 to stop after 1000 packets.

answered 17 Feb '12, 08:41

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%