Senthil Kumar S <senthilkumar.s@...> writes:
> I have an automation requirement, that needs tshark to be stoped upon meeting
certain condition.
>
> From the tshark man pages, I found that stopping condition can be applied with
rrespect to duration, files, file size and multiple files mode.
>
> Is there any stopping condition I can apply through capture filter so that
tshark stops capturing.
>
> ex: Upon receiving a TCP SYN packet (condition applied in capture filter),
tshark stops capturing.
>
> Please let me know any option like this is available.
This functionality is not yet available, although it has been requested and is
being tracked in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2039. You
might want to add yourself to the "CC List" for the bug, and then you will be
automatically notified of any activity surrounding it.
- Chris