Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

When using the -r option, tshark is not in capture mode so capture options are not allowed.

If you want to rotate test.pcap, use -w - and pipe to "magic code here".

dumpcap has a -f <capture filter> option that can limit the data captured and sent to tshark.

tshark man page
-r|--read-file <infile> - Read packet data from infile, ...


       * "-r" was specified, so we're reading a capture file.
       * Capture options don't apply here.