Ask Your Question
0

tshark stopping without capturing any packets with -c <packet count> option

asked 2018-08-09 06:09:41 +0000

donniemillan gravatar image

updated 2018-08-09 06:10:42 +0000

$ tshark -i en0 -I -Y "wlan.rsn.ie.pmkid" -c 1

Capturing on 'Wi-Fi'

10 packets dropped

0 packets captured

Why is this capture stopping before capturing the specified 1 packet?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-08-09 15:13:54 +0000

cmaynard gravatar image

The 0 packets captured is a bit misleading.

Since you didn't specify a capture filter, tshark (dumpcap actually) has captured packets; it's just that your display filter isn't displaying any of them because none of the captured packets matched the display filter.

If you want to stop capturing after 1 packet, then you need to specify a suitable capture filter, not a display filter. Refer to the pcap-filter man page for help with capture filters.

edit flag offensive delete link more

Comments

It looks like what I want isn't possible.

I want tshark to run until it captures a wlan.rsn.ie.pmkid frame, and then for tshark to stop. Do you know if this is possible?

donniemillan gravatar imagedonniemillan ( 2018-08-10 00:49:56 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-08-09 06:09:41 +0000

Seen: 45 times

Last updated: Aug 09