Limiting tsharks /tmp file

I have a long running tshark session. I don't create a local file but instead process the results of StdOut.

Recently I've found that tshark is creating a file in /tmp named wireshark_INTERFACE_TIMESTAMP_RANDOMID.pcapng. Because I am taking a long running pcap this file grows quickly to the point the machine runs out of disk space.

Does anymore know of a way to:

Limit the size of this file?
Stop it being created?
Rotate it after X?

The man page does define a 'ring buffer' mode however i'm not actually producing any capture file. I want these setting for the tmp file, ideally stopping it all together.

I don't really want to kill the process, remove the file and restart capture as I will lose data.

tshark calls dumpcap to do the capture.

You might try having dumpcap write (-w -) to stdout then pipe that into tshark reading (-r -) from stdin.

(Background on the tempfile name here )

Chuckc

answered 2020-04-27 13:53:27 +0000, updated 2020-04-27 13:55:14 +0000

edit flag offensive 0 remove flag delete link

Comments

thanks, this looks like it will work

acid2000 (2020-04-27 15:43:40 +0000) edit

Ideally, if tshark isn't passed a -w flag, tshark should run dumpcap in a mode where it pipes the data to tshark and also has the "control" pipe via which it sends "read N more packets" and other messages, just as it does when writing to a file, as per bug 2743.

Guy Harris (2020-04-28 04:34:58 +0000) edit

Thanks. I didn't think to look to see if there were any bugs around this topic.

Chuckc (2020-04-28 06:13:21 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Limiting tsharks /tmp file edit

Comments

1 Answer

Comments