Ask Your Question

Revision history [back]

To write a pcap file use the -w option, e.g.

tshark -n -i8 -F pcap w output.pcap

Note the -V and -xoptions have been removed as they are used for text output, not pcap output and the -F pcap option has been added to change the output file type to pcap instead of the default pcapng. If you're happy with pcapng, then you can omit the -F pcap option.

click to hide/show revision 2
No.2 Revision

To write a pcap file use the -w option, e.g.

tshark -n -i8 -F pcap w output.pcap

Note the -V and -xoptions have been removed as they are used for text output, not pcap output and the -F pcap option has been added to change the output file type to pcap instead of the default pcapng. If you're happy with pcapng, then you can omit the -F pcap option.

Without the -w option, TShark writes a text file containing information from dissecting the packet (the command in the question will write out packet details, in a fashion similar to what Wireshark shows in the packet details pane). Wireshark can't read those files.