On 30 April 2010 17:38, Jakub Zawadzki
<darkjames@xxxxxxxxxxxxxxxx> wrote:
tshark can't compress trafic (it can only compress already existsing capture files),
I think you need:
# dumpcap -f 'port 25' -w - | gzip - -f > capfile.pcap.gz
or (better comppression but wireshark don't have support for lzma)
# dumpcap -f 'port 25' -w - | xz - -f > capfile.pcap.xz
Thanks, I'm using the gzip one, since I need Wireshark to read it.
Since I don't have a good way to load test it, except with production traffic later next week, I have another question:
During heavy port 25 traffic, bulk (legit) email newsletter, is doing the gzip arrangement above likely to help minimize dropped packets? or is the plain tshark / tcpdump expected to cope better with heavy traffic?
Also could you explain (or point me to an explanation of) the syntax you've given, mainly the lone minus-signs, before the pipe and after the "gzip".