Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Limiting tsharks /tmp file

I have a long running tshark session. I don't create a local file but instead process the results of StdOut.

Recently I've found that tshark is creating a file in /tmp named wireshark_INTERFACE_TIMESTAMP_RANDOMID.pcapng. Because I am taking a long running pcap this file grows quickly to the point the machine runs out of disk space.

Does anymore know of a way to:

  • Limit the size of this file?
  • Stop it being created?
  • Rotate it after X?

The man page does define a 'ring buffer' mode however i'm not actually producing any capture file. I want these setting for the tmp file, ideally stopping it all together.

I don't really want to kill the process, remove the file and restart capture as I will lose data.