Revision history  [back]

tshark man page

Capture to a single file - tshark -i eth0 -i eth1 -w capture.pcapng

Then post process into two files:

$ tshark -r capture.pcapng -2 -R "frame.interface_name==eth0" > eth0.log
$ tshark -r capture.pcapng -2 -R "frame.interface_name==eth1" > eth1.log