This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Be able to specify a range of packets for tshark to read

0

Have a bunch of big pcap files to be processed by tshark. Would like tshark to read first 20 packets of each pcap files first. The benefit is that I can use a script to control whether it's worth to let tshark to consume the entire pcap file. Wonder if there is a command line option to do it.

Thanks.

asked 19 Mar '15, 20:05

sharkfun's gravatar image

sharkfun
26●5●5●9
accept rate: 0%

One Answer:

0

Yes, there is a tshark command-line option available to limit the number of packets read from a capture file. It is the "-c" option. Refer to the tshark man page for more details.

answered 19 Mar '15, 20:18

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Thank you cmaynard for the quick answer! It works.

(19 Mar '15, 20:20) sharkfun