Ask Your Question

tshark command: failed to start process, how to debug this error?

asked 2023-05-11 11:43:54 +0000

username1234 gravatar image

updated 2023-05-11 13:13:53 +0000

grahamb gravatar image

I am using the command line to look through packets in my LAN. I can use the UI and select the LAN manually which shows me the packets I am looking for. However when I use the tshark command;

tshark -i LAN_NAME -f "filter" > E:\temp\log.txt -a packets:1

I get the error "failed to start process: parameter is incorrect <87>". I know this command works, because I use the same command on a different PC that is identical to the one I am having this error on.

edit retag flag offensive close merge delete


Does tshark -v show the version info?

grahamb gravatar imagegrahamb ( 2023-05-11 13:13:35 +0000 )edit

Yes, it's Tshark (Wireshark) 4.0.4. This is running on 64-bit Windows 7 SP1.

username1234 gravatar imageusername1234 ( 2023-05-11 13:32:01 +0000 )edit

Works for me (Win 10), can you show the full output from tshark -v?

grahamb gravatar imagegrahamb ( 2023-05-11 13:56:07 +0000 )edit

So the message wasn't "tshark: Couldn't run (something that includes dumpcap): Parameter is incorrect"?

Guy Harris gravatar imageGuy Harris ( 2023-05-12 00:17:15 +0000 )edit

No, but that's the message I get when I send the command in the post.

username1234 gravatar imageusername1234 ( 2023-05-15 13:08:19 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2023-05-11 19:57:19 +0000

André gravatar image

Apparently this is not caused by tshark itself, but it is Windows that fails to start tshark. For example because an antivirus is interfering.

The site lists probable causes and how to fix it.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2023-05-11 11:43:54 +0000

Seen: 277 times

Last updated: May 11