Is tshark output to file and stdout at the same time possible?

Aug 12, 2013 at 12:15 PM
Hi all,

I'm using dumpcap/tshark for capturing and dissecting files.

I create a process for capturing output to a .pcapng file and I create another process for dissecting the captured data in the file to a human readable form.
This idea is working but a bit cumbersome to me.

What I realy want to do is start one process create a capture file and dissect the data. A command like this:
tshark ... -bduration:60 -Fpcapng -wMyCaptureFile.pcapng -e ...
which should result in a capture file with the raw data created and a text stream with the disected data.

More or less the equivalence of this:
tshark ... -w- -Fpcapng  | tee -wMyCaptureFile.pcapng | tshark -e ...
but now I've lost the possibility to 'fragment' of my capture file into several files.

Is this possible (on a windows 7 64 bit system)? Any idea is welcome.
Aug 16, 2013 at 8:54 AM

Do you want to use Pcap.Net to do that or do you prefer tshark?
For tshark, I think you should ask this someone at WinPcap.
For Pcap.Net, can you explain what you want to achieve without referring to tshark?

Aug 17, 2013 at 1:53 PM

I want to use tshark. I guess you are right, I've posted at the wrong group. Sorry.

What I want to achieve is getting a stream, storing the raw data in a file and then disecting the stream.
I found a way to do it by getting the raw data direct form tshark (stdout) and handling the blocks of pcapng data.
Good enough for me at the moment.

Thanks for your reply.

Kind regards,

André Steenveld.