Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] DUMPCAP Syntax for capturing RTP and UNISTIM packets from

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 24 Aug 2007 09:29:36 -0400
J P wrote:
Thanx Jaap!
DUMPCAP seems to work in my testing so far. Am I correct to assume that I can run two instances of DUMPCAP on two Different interfaces at the same time? (I do not have access to my production machine right now)

Yes, it should be fine.

These are the DUMPCAP commands I am proposing to use to capture UNISTIM and RTP packets, rotating every hour with a max of 1000 files:

    * dumpcap -i 2 -f "udp port 5000 or udp portrange 20000-40000" -b
      files:1000 -b duration:3600 -w c:\dump.cap
    * dumpcap -i 3 -f "udp port 5000 or udp portrange 20000-40000" -b
      files:1000 -b duration:3600 -w c:\dump.cap

I'd strongly suggest *not* sending the output from each 'dumpcap' to the same file. Rather, create 2 files (e.g., "dump2.cap" and "dump3.cap") and if later you need only one file then use 'mergecap' to merge them.