Thanks for explaination! I'll try it out.
Meanwhile, can we design a command like
tshark -stop XXXX ?
What's the difficulty there?
Thanks,
Joshua
On Tue, Feb 3, 2009 at 4:18 PM, Guy Harris <[email protected]> wrote:
>
> On Feb 3, 2009, at 3:53 PM, Joshua (Shiwei) Zhao wrote:
>
> > I know that with tshark we can preset an autostop parameter (a
> > duration or number of captured packets). However, if our target
> > capture is quite dynamic, is there a way to nicely and explicitly
> > stop the capture? We can kill the process but many times the capture
> > buffer couldn't be correctly flushed into a file before it's killed.
>
> That depends on how it's killed.
>
> On UN*X, sending it SIGTERM, with, for example, the "kill" command,
> will cause it to cleanly exit, flushing out the buffered packets.
> Sending it a SIGINT by, for example, typing ^C to it while it's
> running in the foreground will also cause it to cleanly exit.
>
> On Windows, currently the only way to get it to cleanly exit is to
> send it a "control-C event"; I don't know whether there's any way to
> do that other than to type ^C to it while it's running.
> ___________________________________________________________________________
> Sent via: Wireshark-dev mailing list <[email protected]>
> Archives: http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
> mailto:[email protected]?subject=unsubscribe
>
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
