Re: Stop criteria using capture or display filters

[Christopher Maynard <Christopher.Maynard () gtech com>]

Senthil Kumar S <senthilkumar.s@...> writes:

> I have an automation requirement, that needs tshark to be stoped upon meeting
certain condition.
>  
> From the tshark man pages, I found that stopping condition can be applied with
rrespect to duration, files, file size and multiple files mode.
>  
> Is there any stopping condition I can apply through capture filter so that
tshark stops capturing.
>  
> ex: Upon receiving a TCP SYN packet (condition applied in capture filter),
tshark stops capturing.
>  
> Please let me know any option like this is available.

This functionality is not yet available, although it has been requested and is
being tracked in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2039.  You
might want to add yourself to the "CC List" for the bug, and then you will be
automatically notified of any activity surrounding it.

- Chris



___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe