Last week I was working with one of my customers in troubleshooting a nagging intermittent performance problem. We can verify this by listing the 10 files in this directory.Hey packet heads! Let's talk about some commands for tshark and dumpcap. ↪ 200/3 (pcap:0/dumpcap:0/flushed:3/ps_ifdrop:0) (98.5%)Īs we can see, the autostop condition we hit was not time, but number of files. Packets received/dropped on interface 'Wi-Fi: en0': We’re using the unix utility time in order to see whether the duration stop condition was hit. In this example, I used a speedtest website to generate a bunch of fake traffic.

overwrites 1st after writing to 1000th file.

after 10 files are created with a -b option.

Go big or go home! In this example, we’re using all of the -a and -b options that don’t interfere with each other. Example: Using a Ringbuffer and Autostop Condition Multiple -a and -b options can be present. If used before -i, can be per interface.įor -a and -b, the colon is required as part of the condition.

-s NUM: Chop each packet at NUM bytes (SnapLen).

-b condition:NUM: Rotate to a new file after duration:NUM (seconds), interval:NUM (seconds), files:NUM, filesize:NUM (kB), or packets:NUM.

-a condition:NUM: Stop capture after duration:NUM (seconds), files:NUM, filesize:NUM (kB), or packets:NUM.

There are four ways to limit the size of your capture.Įach option is linked to the appropriate section on tshark’s manpage: If you are taking a long continuous capture, then space will eventually become aĬoncern for this capture file. Otherwise, a temporary file is created and located somewhere.

If you specify a file to save to with -w, then it will be that one.

When capturing, *shark will save packets to a file. You should use these options only after optimizing your capture filter to drop unimportant packets.

Tshark filter examples