 | 1 | initial version |
Hi, Though it won't be ideal case but in my case I broke this requirement in smaller tasks step 1. using tshark find 1st interesting packet step 2. using tshark filter skip all the packets before interesting packet & write remaining packets to separate file for subsequent processing. Since end-goal was important - I preferred this work-around rather than processing 10GB+ pcap file in every single tshark run.
