Ask Your Question
0

Wireshark Ring Buffer settings from Command line

asked 2019-03-21 04:29:25 +0000

Ro Yo Mi gravatar image

updated 2019-03-21 04:56:02 +0000

I'm running Wireshark 3.0.0 for Windows 64bit

If I start Wireshark from the command line with the following parameters: -b duration:3600 -b filesize:2000 -b files:30 -w c:\windows\temp\filename.pcapng

Then Wireshark does start but the ring buffer setting page in Wireshark will show the correct settings for Filesize and Files, but the duration field will be disabled.

Is there something I should be doing differently?

edit retag flag offensive close merge delete

Comments

A couple questions:

  • What happens when you specify an interface with -i "the interface"?
  • Why do you want to change the duration mid-capture?
  • To understand whether you should be doing something differently, what are you trying to do now?
Ross Jacobs gravatar imageRoss Jacobs ( 2019-03-21 22:37:30 +0000 )edit

My use case: Wireshark launched with vanilla settings and left with a running capture will eventually use all available system resources, which is especially bad for production servers. To prevent this I've been using the ring buffer which periodically clears memory, but setting up the ring buffer at each launch of the application is tedious at best. Since Wireshark doesn't remember settings I want to include ring buffer settings on the command line.

When I use the -i option and the -b options I receive the same problem.

These same -b options work as expected in TShark. So it seems natural that they should work for Wireshark too.

Ro Yo Mi gravatar imageRo Yo Mi ( 2019-03-23 03:30:22 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-03-22 18:58:29 +0000

JeffMorriss gravatar image

Actually it seems that there's some confusion/mismatch between the command line and the GUI. The time option presented in the GUI is actually the interval option from the command line. The duration option is not actually presented in the GUI at all.

I've proposed a change to clean this up (exposing both options in the GUI) in this change: https://code.wireshark.org/review/32526 . That's significant enough that it may not get back-ported to the 3.0 branch though.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

2 followers

Stats

Asked: 2019-03-21 04:29:25 +0000

Seen: 80 times

Last updated: Mar 22