 | 1 | initial version |
To write a pcap file use the -w option, e.g.
tshark -n -i8 -F pcap w output.pcap
Note the -V and -xoptions have been removed as they are used for text output, not pcap output and the -F pcap option has been added to change the output file type to pcap instead of the default pcapng. If you're happy with pcapng, then you can omit the -F pcap option.
| | 2 | No.2 Revision |
To write a pcap file use the -w option, e.g.
tshark -n -i8 -F pcap w output.pcap
Note the -V and -xoptions have been removed as they are used for text output, not pcap output and the -F pcap option has been added to change the output file type to pcap instead of the default pcapng. If you're happy with pcapng, then you can omit the -F pcap option.
Without the -w option, TShark writes a text file containing information from dissecting the packet (the command in the question will write out packet details, in a fashion similar to what Wireshark shows in the packet details pane). Wireshark can't read those files.