Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] A few questions...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Stef <stefmit@xxxxxxxxx>
Date: Wed, 1 Dec 2004 10:44:17 -0600
On Wed, 01 Dec 2004 16:41:06 +0100, Marco van den Bovenkamp
<marco@xxxxxxxxxxxxxxxxxxx> wrote:
> Amir Oded wrote:
> 
> > 1. I know it is possible to start capturing from the command line, and I
> > am wondering if there is a command for stopping the capture and saving
> > it to a file using a different command. Until now all I could accomplish was start and capture
> > within a single command. What I need is the option to start and stop the
> > capture in two commands instead of one. Is this supported by tethereal?
> 
> Not directly, but you could just 'kill -QUIT' the tethereal process (on
> Unix). There are probably ways to do it on Windows as well, if that's
> what you're using.

http://www.sysinternals.com/ntw2k/freeware/pskill.shtml

If I am not mistaken, the Windows one may leave you with truncated captures.

> 
> > 2. In order to use the capture files in my environment I need to use the
> > "print" option from the file menu, and then printing to a file in
> > expended mode (I am using a parser for the results), is there a possibility to do this from the command
> > line, and that the capture savefile will automatically be in that format.
> 
> Look at the '-V' option (and perhaps '-x' as well) and redirect the
> output to a file.
> 
> --
> 
>                 Regards,
> 
>                         Marco.
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>