I have a yealink ip phone that I would like to capture in real time. The phone's web gui will begin downloading / writing to a file using the "enhanced capture" feature. It stops writing when I click "stop capture" in the web gui. Is there a way to tee, "tail", or pipe this to the .pcap file that tshark can read in real time, so that I can ascertain which button presses/features/calls/conferences/transfers on the phone correlate to what packet at what time, as they happen, rather than after the capture? I suspect that the answer is at the Windows OS level or browser/addon/plugin level, and not a tshark feature, but I thought this is the best place to ask.
I'll be switching over to Linux for troubleshooting in the near future, so what is the proper Linux way to do this?
