Ask Your Question
0

tshark tmp file not stop growing

asked 2019-04-15 16:34:53 +0000

xq1xq1xq1 gravatar image

updated 2019-04-15 16:35:19 +0000

I am sending packets from tshark into elasticsearch:

tshark -i ens5 -T ek -x -j -l

My issue is that the tmp file still has the initial packet in it and continues to grow:

capinfos /tmp/wireshark_ens5_20190411122510_JlODTv.pcapng | grep time First packet time:
2019-04-11 12:25:10.637409777 Last packet time: 2019-04-15

Is there any method of pruning the tshark tmp file after the data has been sent to elasticsearch?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2019-04-15 20:21:17 +0000

Guy Harris gravatar image

Is there any method of pruning the tshark tmp file after the data has been sent to elasticsearch?

No. There is, at best, a method for discarding packets once more than a certain number have been written - the ring buffer option mentioned by @Jaap.

See bug 2743.

edit flag offensive delete link more
0

answered 2019-04-15 17:56:16 +0000

Jaap gravatar image

Have you looked into the capture ring buffer option -b, see the manual page.

edit flag offensive delete link more

Comments

In my case the packets are being fed into ElasticSearch in RealTime.

There is no purpose for having the packets stored in a file once they are ingested into ElasticSearch.

As such, I do not see a ringbuffer working, am I missing something?

xq1xq1xq1 gravatar imagexq1xq1xq1 ( 2019-04-15 19:13:06 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-04-15 16:34:53 +0000

Seen: 801 times

Last updated: Apr 15 '19