Wireshark · Wireshark-dev: Re: [Wireshark-dev] Is it must to have dumpcap built in wireshark-1.0.0in order to do capturing.

["Lars Ruoff" <lars.ruoff@xxxxxxxxxxxxxxxxx>]

> Is it must to have dumpcap built along with tshark to get packet captured?

Yes.

> and if it can't run without dumpcap then why the configure option of
disable-dumpcap?

You can run tshark on files (see option -r) rather than on life capture
data.
In this mode you do NOT need dumpcap, hence the build option.

Br,
Lars