This project is read-only.

How to create capture files with a fixed number of frames?

Aug 12, 2013 at 1:00 PM
Edited Aug 12, 2013 at 1:01 PM
It is possible to create capture files in 'fragments' with the help of tshark option -b (also available in dumpcap.exe)
 Capture output:
   -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
                            filesize:NUM - switch to next file after NUM KB
                               files:NUM - ringbuffer: replace after NUM files
It is possible do fragment on duration or file size with control over a ringbuffer.

The problem I have is that I want to look up a particular frame with a known frame number (and time stamp). This frame can be in any of the capture fragments.

I have noticed that fragmenting on timestamp is creating new files based on the hh:mm:ss it started but switching to the next fragment can cause some frames to be in an unexpected fragment. This occures only within the second of switching to the next fragment.

What I want is fragmenting based on frame number. e.g.:
tshark -b frames:1000
How can I fragment files based on the number of frames received? Any idea is welcome.
Aug 16, 2013 at 9:43 AM
This looks like a question to WinPcap, as tshark is part of WinPcap and not part of Pcap.Net.
How is this question related to Pcap.Net?
Aug 17, 2013 at 2:57 PM
You are right, it is a WinPcap question and I now realise this is the wrong place to ask.