Ask Your Question
0

Is there a replacement for the -Q cli option?

asked 2024-05-01 20:34:47 +0000

DaveDixon gravatar image

updated 2024-05-02 08:18:24 +0000

Guy Harris gravatar image

Wireshark 0.99.6 CLI had -Q option that caused Wireshark to exit when capture is complete. I have to use wireshark and not tshark because I'm capturing from a virtual device. It's running headless on a Raspberry Pi so I have to use the CLI. I stop capture with the -aduration: option, which works, but wireshark never exits. I could run a zombie killer, I suppose, but it would be so much nicer if it would just exit when done. Is there a way to do that?

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2024-05-01 21:06:42 +0000

Chuckc gravatar image
edit flag offensive delete link more

Comments

Dumpcap is the reason tshark doesn't work - it only works on physical interfaces.

DaveDixon gravatar imageDaveDixon ( 2024-05-01 22:05:26 +0000 )edit

WIRESHARK_QUIT_AFTER_CAPTURE works perfectly, thanks!! I guess I never got that far in the documentation!

DaveDixon gravatar imageDaveDixon ( 2024-05-01 22:14:23 +0000 )edit

I have to use wireshark and not tshark because I'm capturing from a virtual device.

...

Dumpcap is the reason tshark doesn't work - it only works on physical interfaces.

What do you mean by "virtual device"? Dumpcap can capture on anything tcpdump can capture on, as they both use libpcap for capturing. Are you referring to an "extcap" device?

Guy Harris gravatar imageGuy Harris ( 2024-05-02 08:14:47 +0000 )edit

Yes, extcap.

DaveDixon gravatar imageDaveDixon ( 2024-05-02 10:29:38 +0000 )edit

What happens if you try to use an extcap with tshark?

Guy Harris gravatar imageGuy Harris ( 2024-05-02 23:21:03 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2024-05-01 20:34:47 +0000

Seen: 124 times

Last updated: May 03