4 ms·
tshark is supposed to be a tcpdump alternative but it seems tcpdump is still dominant on the command line these days.
by ausjke 8y ago
tshark is supposed to be a tcpdump alternative but it seems tcpdump is still dominant on the command line these days.
- assafmo 8y agotshark always hogs my RAM and eventually crashes on > 4GB pcaps. I'd love to have a solution for this.
- lir 8y agoTry dumpcap [0], also part of the Wireshark suite. It's the back-end engine used by the Wireshark GUI as well as tshark. tshark tracks state for streams the same way the GUI will and eats your RAM, whereas dumpcap is a dumb siphon (with filtering). 0: https://www.wireshark.org/docs/man-pages/dumpcap.html https://www.wireshark.org/docs/man-pages/dumpcap.html