I have a long running tshark session. I don't create a local file but instead process the results of StdOut.
Recently I've found that tshark is creating a file in /tmp named wireshark_INTERFACE_TIMESTAMP_RANDOMID.pcapng. Because I am taking a long running pcap this file grows quickly to the point the machine runs out of disk space.
Does anymore know of a way to:
- Limit the size of this file?
- Stop it being created?
- Rotate it after X?
The man page does define a 'ring buffer' mode however i'm not actually producing any capture file. I want these setting for the tmp file, ideally stopping it all together.
I don't really want to kill the process, remove the file and restart capture as I will lose data.