Limiting tsharks /tmp file

asked 2020-04-27 08:27:34 +0000

acid2000
3 ●3 ●5 ●6

I have a long running tshark session. I don't create a local file but instead process the results of StdOut.

Recently I've found that tshark is creating a file in /tmp named wireshark_INTERFACE_TIMESTAMP_RANDOMID.pcapng. Because I am taking a long running pcap this file grows quickly to the point the machine runs out of disk space.

Does anymore know of a way to:

Limit the size of this file?
Stop it being created?
Rotate it after X?

The man page does define a 'ring buffer' mode however i'm not actually producing any capture file. I want these setting for the tmp file, ideally stopping it all together.

I don't really want to kill the process, remove the file and restart capture as I will lose data.

answered 2020-04-27 13:53:27 +0000

Chuckc
2858 ●5 ●567 ●19

updated 2020-04-27 13:55:14 +0000

tshark calls dumpcap to do the capture.

You might try having dumpcap write (-w -) to stdout then pipe that into tshark reading (-r -) from stdin.

(Background on the tempfile name here )

edit flag offensive delete link

Comments

thanks, this looks like it will work

acid2000 ( 2020-04-27 15:43:40 +0000 )edit

Ideally, if tshark isn't passed a -w flag, tshark should run dumpcap in a mode where it pipes the data to tsharkand also has the "control" pipe via which it sends "read N more packets" and other messages, just as it does when writing to a file, as per bug 2743.

Guy Harris ( 2020-04-28 04:34:58 +0000 )edit

Thanks. I didn't think to look to see if there were any bugs around this topic.

Chuckc ( 2020-04-28 06:13:21 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Limiting tsharks /tmp file

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Limiting tsharks /tmp file edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Limiting tsharks /tmp file