Wireshark-users: Re: [Wireshark-users] DumpCap and Multiple Files

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Tue, 04 Jul 2006 20:29:39 +0200

Shlomo Taub wrote:

Thanks for the pointer - this is exactly the problem which I have been having. (Having tested further, it looks like the restarts may have been a red herring.)

What is the purpose of -a along with -b?

You may have a look at the manpage/HTML page about dumpcap. If you can't find one, use http://www.ethereal.com/docs/man-pages/ethereal.1.html instead, as the meaning of these parameters are the same for dumpcap and Ethereal.

Simplified: -a specifies when to stop the whole capture process while -b is the criteria when to switch to a new file.

Regards, ULFL