Ask Your Question

Revision history [back]

Tshark - Can I use ring buffer with text files

Hello, I log a lot of data and I use text files with tshark, using "-T json" option. I want to create small multiple text files instead of 1 big file. I tried the "-b interval:1000 -b files:100" to create subfiles of 1Mo but it only works for pcap files, not for json (wich is the output by the way). Do you know a way of doing it with tshark ?

If not I will have to try to change the output path during the acquisition. Or stopping then restarting with new path...but I'm not really satisfied with this... Thanks and see you.