Help with using dumpcap to monitor 24/7 but retain only 20 minutes

savecancel

dumpcap man page

Hello and thank you for this reply.

When you say to use dumpcap directly, do you mean from the Windows Command Prompt?

Is there a way to include in the dumpcap command I provided a filter to only capture my MAC address?

Thank you.

I've tried using this dumpcap command from Windows Command Prompt but I'm receiving a syntax error on the filter part:

dumpcap -i 1 -w E:\wiresharkLogs\32Scapture.pcapng -b duration:1200 -b files:5 -f "eth.addr==xx:55:44:33:2C:xx"

You're trying to use a display filter as capture filter, that doesn't work. Use ether host xx:55:44:33:2C:xx instead.

However in this case, rather than using this filter, I would use the `-p' option, see the dumpcap man page.

Thanks very much..this was the filter I needed to use.

For anyone else finding this post here is the full dumpcap I used to capture 5 pcapng files every 20 minutes:

dumpcap -i 1 -w E:\wiresharkLogs\capture.pcapng -b duration:1200 -b files:5 -f "ether host xx:55:44:33:2C:xx"