Aug 12, 2013 at 12:00 PM
Edited Aug 12, 2013 at 12:01 PM
It is possible to create capture files in 'fragments' with the help of tshark option -b (also available in dumpcap.exe)
-b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
filesize:NUM - switch to next file after NUM KB
files:NUM - ringbuffer: replace after NUM files
It is possible do fragment on duration or file size with control over a ringbuffer.
The problem I have is that I want to look up a particular frame with a known frame number (and time stamp). This frame can be in any of the capture fragments.
I have noticed that fragmenting on timestamp is creating new files based on the hh:mm:ss it started but switching to the next fragment can cause some frames to be in an unexpected fragment. This occures only within the second of switching to the next fragment.
What I want is fragmenting based on frame number. e.g.:
tshark -b frames:1000
How can I fragment files based on the number of frames received? Any idea is welcome.