If you encounter packet drops while capturing, try to increase this size. This is used by the the capture driver to buffer packet data until that data can be written to disk. In those situations, you can specify a capture buffer size in MB using -B option. This scenario is helpful when you are facing packet drops during capture. # tshark -b filesize:10240 -b duration:1 -w temp.pcap You can use auto-stop conditions accordingly. But, it will switch to new files when file size reaches 10240 KB or when 1 second is elapsed. The following example will capture the network traffic to multiple files. files:20 indicates that the total number of output files that should be created is 20Ģ.filesize:100 indicates that the maximum size of the output capture file is 100 KB.# tshark -b filesize:100 -a files:20 -w temp.pcap The following example will capture the network traffic to 20 files, each sized 100 KB, and then the capture will stop automatically. In that situation, instead of storing all the outputs in a single file, you may want to automatically break down the captures into multiple files based on a size that you specify. You like to use these captures later to analyze the data. You’ll understand how to auto-save captures to multiple files, auto-save captures based on time limits, specify your own buffer size for capture, extract specific fields from the capture, and display statistics for a specific protocol from a capture.įor example on your production server, you want to capture traffic data for an extended period of time. This tutorial explains few practical and useful scenarios in using the tshark command.

Tshark capture filter