Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Compressed capture?

From: Darren Tay <gluino@xxxxxxxxx>
Date: Fri, 30 Apr 2010 19:32:25 +0800

On 30 April 2010 17:38, Jakub Zawadzki <darkjames@xxxxxxxxxxxxxxxx> wrote:

tshark can't compress trafic (it can only compress already existsing capture files),
I think you need:

# dumpcap -f 'port 25' -w - | gzip - -f > capfile.pcap.gz
or (better comppression but wireshark don't have support for lzma)
# dumpcap -f 'port 25' -w - | xz - -f > capfile.pcap.xz


Thanks, I'm using the gzip one, since I need Wireshark to read it.

Since I don't have a good way to load test it, except with production traffic later next week, I have another question:
During heavy port 25 traffic, bulk (legit) email newsletter, is doing the gzip arrangement above likely to help minimize dropped packets? or is the plain tshark / tcpdump expected to cope better with heavy traffic?

Also could you explain (or point me to an explanation of) the syntax you've given, mainly the lone minus-signs, before the pipe and after the "gzip".