[M Holt <m.iostreams@xxxxxxxxx>]

Can you just use dumpcap with a ring buffer?  Then stop the capture once the event you are looking for is seen:

http://www.wireshark.org/docs/man-pages/dumpcap.html

On Sat, May 15, 2010 at 10:02 AM, mike@xxxxxxxxxxxx <mike@xxxxxxxxxxxx> wrote:

Any way of monitoring only, without a capture, until I need to capture?

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe