Wireshark-users: Re: [Wireshark-users] How can I run tshark for days at a time without running ou
On Thu, Jul 24, 2008 at 11:05:59PM +0400, Abhik Sarkar wrote:
> On Thu, Jul 24, 2008 at 9:10 PM, Marc MERLIN <marc_ws@xxxxxxxxxxx> wrote:
> > Can I either:
> > 1) skip dumpcap and not have an ever growing file?
> From what I understand, dumpcap was introduced to meet this objective:
> http://wiki.wireshark.org/Development/PrivilegeSeparation. tshark
> spawns dumpcap, and capture is not possible without this.
Right. It's a good idea for most, but quite undesirable for me. It'd be nice
if that could be turned off since it prevents running tshark in live capture
mode for a long time.
> > 2) tell tshark to quit when the dumpcap file is 10G and I'll restart it in
> > a loop after /bin/rm /tmp/etherXXX*
> >
> You should not have to clean-up these files manually if the processes
> were terminated cleanly. There has been some discussion on this
> recently, as you might have seen:
> http://www.wireshark.org/lists/wireshark-users/200807/msg00127.html.
> If you are also facing this issue, it probably needs to be looked into
> more carefully.
Honestly, the loss of work from having a 2 day process capture die is high
for me and since I've seen tshark die on out of disk space and the ether
file left around in /tmp, I'm just going to delete them all on restart.
> Here are a few suggestions:
> - you could use the -c option and restart in a loop, but you risk
> losing packets between the restarts
Looks like the winning proposition for me right now.
I'll just set -c 1000000
> - I don't know for sure if it is possible, but you could try the
> reverse of what is mentioned in
> http://wiki.wireshark.org/CaptureSetup/Pipes
I doubt that will work, if have no control over the tempfile dumpcap/tshark
create and share, and if I have tshark output to a file, it turns off
protocol decoding.
> - Haven't ever tried this, but maybe it is possible to use a ring
> buffer with a named pipe as an output file.
> (I am not quite sure if the last two options would prevent the dumpcap
> file from growing though...)
Ouch :)
I think I'll use this for now:
(while :
do
/bin/rm /tmp/etherXXXX*
# tshark uses a tempfile to dump and analyse from, which means we
# can't have it grow forever, so we restart tshark every 1 million
# packets and delete the old file left behind if it died with an error.
tshark -c 1000000 -n -V -l -i eth1 port nfs and host 172.28.80.41
echo "tshark finished with $?, restarting" >&2
done) | ~/analyse_nfs > out$$ 2>err$$
Thanks,
Marc
--
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
.... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/
