ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] DumpCap and Multiple Files

From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Tue, 04 Jul 2006 09:06:39 +0800


Shlomo Taub wrote:
I'm using DumpCap with the -b, -w and filesize options for multiple output files. This works fine on the first run; however, if I stop the capture, then restart with the same options, every packet gets written to a new file. Is there any way to continue a previously interrupted multiple file capture, without changing the file name?

Are you using Ethereal 0.99.0? In that case you're probably hitting bug 895:

http://bugs.ethereal.com/bugzilla/show_bug.cgi?id=895

though the fact that it works the first time does NOT sound like that bug.

If it is that bug, it should be fixed in the Wireshark 0.99.1pre1 pre-release.