Wireshark-dev: Re: [Wireshark-dev] explicitly stop capture with Tshark

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 3 Feb 2009 16:18:31 -0800

On Feb 3, 2009, at 3:53 PM, Joshua (Shiwei) Zhao wrote:

I know that with tshark we can preset an autostop parameter (a duration or number of captured packets). However, if our target capture is quite dynamic, is there a way to nicely and explicitly stop the capture? We can kill the process but many times the capture buffer couldn't be correctly flushed into a file before it's killed.

That depends on how it's killed.

On UN*X, sending it SIGTERM, with, for example, the "kill" command, will cause it to cleanly exit, flushing out the buffered packets. Sending it a SIGINT by, for example, typing ^C to it while it's running in the foreground will also cause it to cleanly exit.

On Windows, currently the only way to get it to cleanly exit is to send it a "control-C event"; I don't know whether there's any way to do that other than to type ^C to it while it's running.