This option is not available under Windows.Īfter reading in a capture file using the -r flag, go to the given packet number. A hostname and screen (otherhost:0.0) or just a screen (:0.0) can be (for example, as root), then, if Wireshark is run with the -D flag and is not run from such anĪccount, it will not list any interfaces. On your system, a program doing a network capture must be run from an account with special privileges Note that 'can capture' means that Wireshark was able to open that device to do a live capture if, Interface name is a somewhat complex string. Systems lacking ifconfig -a) the number can be useful on Windows 2000 and later systems, where the This can be useful on systems that don't have a command to list them (e.g., Windows systems, or UNIX The interface name or the number can be supplied to the -i flag to specify an interface on which to For each network interface,Ī number and an interface name, possibly followed by a text description of the interface, is printed. D Print a list of the interfaces on which Wireshark can capture, and exit. Start with the given configuration profile. Set the maximum number of packets to read when capturing live data. UNIX systems with earlier versions of libpcap. This is available on UNIX systems with libpcap 1.0.0 or later and on Windows. Note that, while Tshark attempts to set the buffer size to 1MB byĭefault, and can be told to set it to a larger value, the system or interface on which you'reĬapturing might silently limit the capture buffer size to a lower value or raise it to a higher If you encounter packet drops while capturing, Packet data until that data can be written to disk. This is used by the the capture driver to buffer Set capture buffer size (in MB, default is 1MB). When the first capture file fills up, Wireshark will switch writing to the

In 'multiple files' mode, Wireshark will write to Writing to the current capture file and switch to the next one if filesize is reached.įiles: value Stop writing to capture files after value number of files were written.Ĭause Wireshark to run in 'multiple files' mode. If this option is used together with the -b option, Wireshark will stop TheĬriterion is of the form test : value, where test is one of:ĭuration: value Stop writing to a capture file after value seconds have elapsed.įilesize: value Stop writing to a capture file after it reaches a size of value kilobytes (where a Specify a criterion that specifies when Wireshark is to stop writing to a capture file.

Wireshark command line capture