On Jul 24, 2008, at 10:10 AM, Marc MERLIN wrote:
I'm currently running tshark like this:
tshark -n -V -l -i eth1 port nfs and host 172.28.80.41 | myscript
I need this to run for days and days.
Tshark however seems to capture to /tmp/etherXXXXjRZvbB with dumpcap
It shouldn't be doing that if tshark isn't run with the -w flag; it
should, instead, tell dumpcap to write the capture to a pipe, and read
from the pipe, so that it doesn't waste disk space on packets that
will be read once to dissect them and never read again. See bug 2743,
which I just filed.