Tshark does not save files in a ring
I'm trying to capture files in a ring buffer, but it seems like tshark ignores files:10 What am I doing wrong?
"C:\Program Files\Wireshark\tshark" -i "Ethernet 4" -b filesize:100 -b files:10 -w capture.pcap
Capturing on 'Ethernet 4'
** (tshark:5936) 17:54:33.111802 [Main MESSAGE] -- Capture started.
** (tshark:5936) 17:54:33.120450 [Main MESSAGE] -- File: "capture_00001_20240315175433.pcap"
783 ** (tshark:5936) 17:54:47.823130 [Main MESSAGE] -- File: "capture_00002_20240315175447.pcap"
1560 ** (tshark:5936) 17:55:02.201369 [Main MESSAGE] -- File: "capture_00003_20240315175502.pcap"
2340 ** (tshark:5936) 17:55:16.886229 [Main MESSAGE] -- File: "capture_00004_20240315175516.pcap"
3123 ** (tshark:5936) 17:55:31.022563 [Main MESSAGE] -- File: "capture_00005_20240315175531.pcap"
3896 ** (tshark:5936) 17:55:45.261889 [Main MESSAGE] -- File: "capture_00006_20240315175545.pcap"
4677 ** (tshark:5936) 17:55:59.911016 [Main MESSAGE] -- File: "capture_00007_20240315175559.pcap"
5454 ** (tshark:5936) 17:56:14.487242 [Main MESSAGE] -- File: "capture_00008_20240315175614.pcap"
6235 ** (tshark:5936) 17:56:28.918045 [Main MESSAGE] -- File: "capture_00009_20240315175628.pcap"
7012 ** (tshark:5936) 17:56:43.249923 [Main MESSAGE] -- File: "capture_00010_20240315175643.pcap"
7796 ** (tshark:5936) 17:56:57.954122 [Main MESSAGE] -- File: "capture_00011_20240315175657.pcap"
8568 ** (tshark:5936) 17:57:12.413741 [Main MESSAGE] -- File: "capture_00012_20240315175712.pcap"
What version of
tsharkis running? (Output oftshark -v)Did you look on disk to see if more than 10 files exist?
The filenames will continue to increment:
03/15/2024 09:39 AM 6,284 capture_00043_20240315093900.pcapCorrect, it deletes the older files.