Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

tshark ring-buffer duration vs interval

I am looking at the documentation for tshark -b, and it's unclear to me what the difference is between "interval" and "duration". Both are in seconds and at the end of NUM seconds, the file rotates.

For example, what is the difference between these two commands?

tshark -b files:5 -b duration:10 -w file
tshark -b files:5 -b interval:10 -w file

In both cases, I see the filename endings change and increase by 10 about every 10s that look something like this:

bash:/tmp/duration-test$ ls -1
file_00003_20190808003713
file_00004_20190808003723
file_00005_20190808003733
file_00006_20190808003743
file_00007_20190808003753