 | 1 | initial version |
tshark man page
Capture to a single file - tshark -i eth0 -i eth1 -w capture.pcapng
Then post process into two files:
$ tshark -r capture.pcapng -2 -R "frame.interface_name==eth0" > eth0.log $ tshark -r capture.pcapng -2 -R "frame.interface_name==eth1" > eth1.log
