I'm using dumpcap/tshark for capturing and dissecting files.
I create a process for capturing output to a .pcapng file and I create another process for dissecting the captured data in the file to a human readable form.
This idea is working but a bit cumbersome to me.
What I realy want to do is start one process create a capture file and
dissect the data. A command like this:
tshark ... -bduration:60 -Fpcapng -wMyCaptureFile.pcapng -e ...
which should result in a capture file with the raw data created and a text stream with the disected data.
More or less the equivalence of this:
tshark ... -w- -Fpcapng | tee -wMyCaptureFile.pcapng | tshark -e ...
but now I've lost the possibility to 'fragment' of my capture file into several files.
Is this possible (on a windows 7 64 bit system)? Any idea is welcome.