Wireshark-users: Re: [Wireshark-users] Using multiple files with tshark

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Wed, 28 Feb 2007 14:53:32 -0800

On Wed, Feb 28, 2007 at 05:11:48PM -0000, McGlinchy, Alistair wrote:

> 	D:\>tshark -b duration:60 -w test.cap -f http
> 	tshark: Multiple capture files requested, but no maximum capture
> file size was specified.

> At line 1288 of tshark.c there seems that the command validation only 
> allows the filesize method of autostopping.

> I have naively tweaked this to try to allow for a duration instead but 
> it makes no difference.
> 
> 	  if (!capture_opts.has_autostop_filesize &&
>               !capture_opts.has_autostop_duration ) {

You got very close to fixing it.  However, you are testing the 
autostop_duration variable (which is set when using -a) and not the 
ring-buffer duration variable (capture_opts.has_file_duration).  This 
fixes it:

          if (!capture_opts.has_autostop_filesize &&
	      !capture_opts.has_file_duration) {

I have checked this fix into the SVN repository as revision 20950.  You 
can either fix your local source manually or download the latest 
developer source code/Windows binaries from 
http://downloads.wireshark.org/download/automated/ in a few hours.
 
Thanks for bringing it to our attention!


Steve