https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16518
Bug ID: 16518
Summary: Using -P breaks multiple file capture
Product: Wireshark
Version: 3.2.3
Hardware: x86
OS: Debian
Status: UNCONFIRMED
Severity: Major
Priority: Low
Component: TShark
Assignee: bugzilla-ad...@wireshark.org
Reporter: jaap.keu...@xs4all.nl
Target Milestone: ---
Build Information:
TShark (Wireshark) 3.2.4 (v3.2.4rc0-10-gef50d8f38888)
Copyright 1998-2020 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<https://www.gnu.org/licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with GLib 2.64.1, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with
Lua
5.2.4, with GnuTLS 3.6.13 and PKCS #11 support, with Gcrypt 1.8.5, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.40.0, with brotli, with LZ4,
with Zstandard, with Snappy, with libxml2 2.9.10.
Running on Linux 5.5.0-1-amd64, with Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
(with SSE4.2), with 15961 MB of physical memory, with locale en_US.UTF-8, with
libpcap version 1.9.1 (with TPACKET_V3), with GnuTLS 3.6.13, with Gcrypt 1.8.5,
with brotli 1.0.7, with zlib 1.2.11, binary plugins supported (0 loaded).
Built using gcc 9.3.0.
--
Running TShark with options for multiple files / circular buffer (-b), and thus
-w, together with -P (print dissection output even while writing to capture
file) the process stops after completion of the first file. It does start the
output of the second file, but is does stop early on.
$ run/tshark -i eno1 -w /tmp/tshark -b files:5 -b filesize:10 -P not tcp port
22
Capturing on 'eno1'
1 0.000000000 ....
35 2.293596917 ....
1 0.000000000 ....
36 packets captured
$ cd /tmp
/tmp$ ll tshark*
-rw------- 1 user user 10152 Apr 28 10:13 tshark_00001_20200428101353
-rw------- 1 user user 744 Apr 28 10:13 tshark_00002_20200428101358
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
