> Is it must to have dumpcap built along with tshark to get packet captured?
Yes. > and if it can't run without dumpcap then why the configure option of disable-dumpcap? You can run tshark on files (see option -r) rather than on life capture data. In this mode you do NOT need dumpcap, hence the build option. Br, Lars _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
