First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

tshark stopping without capturing any packets with -c <packet count> option

  • retag add tags

$ tshark -i en0 -I -Y "wlan.rsn.ie.pmkid" -c 1

Capturing on 'Wi-Fi'

10 packets dropped

0 packets captured

Why is this capture stopping before capturing the specified 1 packet?

donniemillan's avatar
1
donniemillan
asked 2018-08-09 06:09:41 +0000, updated 2018-08-09 06:10:42 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

The 0 packets captured is a bit misleading.

Since you didn't specify a capture filter, tshark (dumpcap actually) has captured packets; it's just that your display filter isn't displaying any of them because none of the captured packets matched the display filter.

If you want to stop capturing after 1 packet, then you need to specify a suitable capture filter, not a display filter. Refer to the pcap-filter man page for help with capture filters.

cmaynard's avatar
11.1k
cmaynard
answered 2018-08-09 15:13:54 +0000
edit flag offensive 0 remove flag delete link
more

Comments

It looks like what I want isn't possible.

I want tshark to run until it captures a wlan.rsn.ie.pmkid frame, and then for tshark to stop. Do you know if this is possible?

donniemillan's avatar donniemillan (2018-08-10 00:49:56 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer