 | 1 | initial version |
When using the -r option, tshark is not in capture mode so capture options are not allowed.
If you want to rotate test.pcap, use -w - and pipe to "magic code here".
dumpcap has a -f <capture filter> option that can limit the data captured and sent to tshark.
tshark man page
-r|--read-file <infile> - Read packet data from infile, ...
tshark.c
/*
* "-r" was specified, so we're reading a capture file.
* Capture options don't apply here.
*/