Revision history [back]

When using the -r option, tshark is not in capture mode so capture options are not allowed.

If you want to rotate test.pcap, use -w - and pipe to "magic code here".

dumpcap has a -f <capture filter> option that can limit the data captured and sent to tshark.

tshark man page
-r|--read-file <infile> - Read packet data from infile, ...

tshark.c

      /*
       * "-r" was specified, so we're reading a capture file.
       * Capture options don't apply here.
       */