Wireshark · Wireshark-dev: Re: [Wireshark-dev] explicitly stop capture with Tshark

["Joshua (Shiwei) Zhao" <swzhao@xxxxxxxxx>]

Thanks for explaination! I'll try it out.

 

Meanwhile, can we design a command like

    tshark -stop XXXX  ?

What's the difficulty there?

 

Thanks,

Joshua

On Tue, Feb 3, 2009 at 4:18 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:

On Feb 3, 2009, at 3:53 PM, Joshua (Shiwei) Zhao wrote:

> I know that with tshark we can preset an autostop parameter (a
> duration or number of captured packets). However, if our target
> capture is quite dynamic, is there a way to nicely and explicitly
> stop the capture? We can kill the process but many times the capture
> buffer couldn't be correctly flushed into a file before it's killed.

That depends on how it's killed.

On UN*X, sending it SIGTERM, with, for example, the "kill" command,
will cause it to cleanly exit, flushing out the buffered packets.
Sending it a SIGINT by, for example, typing ^C to it while it's
running in the foreground will also cause it to cleanly exit.

On Windows, currently the only way to get it to cleanly exit is to
send it a "control-C event"; I don't know whether there's any way to
do that other than to type ^C to it while it's running.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe