command line capture The Technology Firm（命令行捕获科技公司）.pdf

How To Capture from the Command Prompt with Wireshark The Technology Firm © 2007, The Technology Firm WWW.THETECHFIRM.COM Tony Fortunato Things to do 1. Add Wireshark to your path 2. Determine which interface index maps to which NIC 3. Determine your capture parameters and location of your trace files 4. Test, check go back to #2, if things don’t work 5. Final command to capture © 2007, The Technology Firm WWW.THETECHFIRM.COM 2 Add Wireshark to your path To make your Wireshark applications accessible from any directory, simply add Wireshark to your Windows path 3 2 1 © 2007, The Technology Firm WWW.THETECHFIRM.COM 3 Tshark command syntax – Part 1 Usage: tshark [options] ... Capture interface: -i interface name or idx of interface (def: first non-loopback) -f capture filter packet filter in libpcap filter syntax -s snaplen packet snapshot length (def: 65535) -p dont capture in promiscuous mode -B buffer size size of kernel buffer (def: 1MB) -y link type link layer type (def: first appropriate) -D print list of interfaces and exit -L print list of link-layer types of iface and exit Capture stop conditions: -c packet count stop after n packets (def: infinite) -a autostop cond. ... duration:NUM - stop after NUM seconds filesize:NUM - stop this file after NUM KB files:NUM - st