5 ms·
tshark also has a fabulous ring buffer feature that lets you run captures continuously while chunking the files up into manageable sizes. e.g. -b filesize:100
by tacoman 13y ago
tshark also has a fabulous ring buffer feature that lets you run captures continuously while chunking the files up into manageable sizes.
e.g. -b filesize:100000 -b files:200 -w somefile
This will make a ring buffer of 200 * 100MB files.
After typing this, I realized this may have limited use cases, but I use it almost every day.
- scott_karana 13y agoIt's a great ad-hoc solution for monitoring types of traffic. I've used it too. :-)
- sgrossman 13y agoIf you are on a system that doesn't have tshark, tcpdump provides the same functionality via the -C <file_size_in_MB> -W <num_files> flags. e.g. -C 100 -W 200 -w somefile will get you the same circular ring of 200 100MB files. Also, don't forget to add the -s 0 flag if you want to get the entire payload.