Is there a replacement for the -Q cli option?

retag add tags

Wireshark 0.99.6 CLI had -Q option that caused Wireshark to exit when capture is complete. I have to use wireshark and not tshark because I'm capturing from a virtual device. It's running headless on a Raspberry Pi so I have to use the CLI. I stop capture with the -aduration: option, which works, but wireshark never exits. I could run a zombie killer, I suppose, but it would be so much nicer if it would just exit when done. Is there a way to do that?

9efd73b9: -Q → WIRESHARK_QUIT_AFTER_CAPTURE.

See WIRESHARK_QUIT_AFTER_CAPTURE on the Wireshark man page.

d6798876: I'm not sure -Q/WIRESHARK_QUIT_AFTER_CAPTURE is actually useful in batch

Or maybe your captures could be better done with dumpcap.

Chuckc

answered 2024-05-01 21:06:42 +0000

edit flag offensive 0 remove flag delete link

Comments

Dumpcap is the reason tshark doesn't work - it only works on physical interfaces.

DaveDixon (2024-05-01 22:05:26 +0000) edit

WIRESHARK_QUIT_AFTER_CAPTURE works perfectly, thanks!! I guess I never got that far in the documentation!

DaveDixon (2024-05-01 22:14:23 +0000) edit

I have to use wireshark and not tshark because I'm capturing from a virtual device.

...

Dumpcap is the reason tshark doesn't work - it only works on physical interfaces.

What do you mean by "virtual device"? Dumpcap can capture on anything tcpdump can capture on, as they both use libpcap for capturing. Are you referring to an "extcap" device?

Guy Harris (2024-05-02 08:14:47 +0000) edit

Yes, extcap.

DaveDixon (2024-05-02 10:29:38 +0000) edit

What happens if you try to use an extcap with tshark?

Guy Harris (2024-05-02 23:21:03 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Is there a replacement for the -Q cli option? edit

Comments

1 Answer

Comments