This is helpful when you need to specify how a layer type should be dissected. This is same as wireshark “decode as” option, but sometimes specified selector value is different from the value present in packet. # tshark -B 2 Capture Using “decode as” option If you encounter packet drops while capturing, try to increase this size. Used by the the capture driver to buffer packet data until that data can be written to disk. # tshark -b filesize:10240 -b duration:1 -w temp.pcap Specify Capture Buffer Size This command will switch to new file when the file size reaches 10240 KB or when 1 second is elapsed.

files:20 indicates that the total number of output files that should be created is 20Ĭapture traffic to multiple files.filesize:100 indicates that the maximum size of the output capture file is 100 KB.# tshark -b filesize:100 -a files:20 -w temp.pcap

Auto-save Captures to Multiple FilesĬapture the network traffic to 20 files, each sized 100 KB, and then the capture will stop automatically. For more information on, see the manual pages (man tshark). TShark is a terminal oriented version of Wireshark designed for capturing and displaying packets when an interactive user interface isn’t necessary or available.

Man tshark