Wireshark · Ethereal-users: Re: [Ethereal-users] A few questions...

[Marco van den Bovenkamp <marco@xxxxxxxxxxxxxxxxxxx>]

Amir Oded wrote:

> 1. I know it is possible to start capturing from the command line, and I 
> am wondering if there is a command for stopping the capture and saving 
> it to a file using a different command. Until now all I could accomplish was start and capture 
> within a single command. What I need is the option to start and stop the 
> capture in two commands instead of one. Is this supported by tethereal?

Not directly, but you could just 'kill -QUIT' the tethereal process (on 
Unix). There are probably ways to do it on Windows as well, if that's 
what you're using.

> 2. In order to use the capture files in my environment I need to use the 
> "print" option from the file menu, and then printing to a file in 
> expended mode (I am using a parser for the results), is there a possibility to do this from the command 
> line, and that the capture savefile will automatically be in that format.

Look at the '-V' option (and perhaps '-x' as well) and redirect the 
output to a file.

--

		Regards,

			Marco.