Ask Your Question
0

Tshark - Can I use ring buffer with text files

asked 2024-04-10 11:19:36 +0000

TenJigoku gravatar image

Hello, I log a lot of data and I use text files with tshark, using "-T json" option. I want to create small multiple text files instead of 1 big file. I tried the "-b interval:1000 -b files:100" to create subfiles of 1Mo but it only works for pcap files, not for json (wich is the output by the way). Do you know a way of doing it with tshark ?

If not I will have to try to change the output path during the acquisition. Or stopping then restarting with new path...but I'm not really satisfied with this... Thanks and see you.

edit retag flag offensive close merge delete

Comments

The diagram here (WSDG: 7.2. Overview) shows Wireshark but also applies to tshark. Capture (and the ring buffering) is done with dumpcap.
A script monitoring the ring buffer directory looking for new files, process them with tshark to JSON output then discard the capture file? (Easier on *nix (tm). Doable on Windows?)

Chuckc gravatar imageChuckc ( 2024-04-10 14:44:06 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2024-04-10 21:55:49 +0000

Guy Harris gravatar image

Do you know a way of doing it with tshark ?

Text dissections are written by TShark to the standard output, so there is no mechanism in TShark to do that.

You could have a program that reads the -T json output of TShark and writes that out in separate files; that program would have to understand the JSON output to an extent necessary to avoid splitting a single packet's JSON between files.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2024-04-10 11:19:36 +0000

Seen: 117 times

Last updated: Apr 10