 | 1 | initial version |
tshark doesn't have that, and also you do not want to use tshark for this.
Tshark is for packet dissection and that is not what you are after. You're looking for packet capture. Tshark doesn't do that, it spawns dumpcap for this. Tshark then takes that output and dissects it. While doing to it keeps state, which will potentially eventually eat all your memory.
What you want to do instead is use dumpcap directly. Even though it also does not have a post rotation command, it at least works on capture and capture only.
