aboutsummaryrefslogtreecommitdiffstats
path: root/doc/dumpcap.pod
AgeCommit message (Collapse)AuthorFilesLines
2017-08-22Add hardware timestamping supportAhmad Fatoum1-1/+13
pcap provides a pcap_set_tstamp_type function, which can be used to request hardware timestamps from a supporting kernel. This patch adds support for aforementioned function as well as two new command line options to dumpcap, wireshark and tshark: --list-time-stamp-types List time stamp types supported for the interface --time-stamp-type <type> Change the interface's timestamp method Name choice mimics those used by tcpdump(1), which already supports this feature. However, unlike tcpdump, we provide both options unconditionally. If Wireshark was configured without pcap_set_tstamp_type being available, --list-time-stamp-types reports an empty list. Change-Id: I418a4b2b84cb01949cd262aad0ad8427f5ac0652 Signed-off-by: Ahmad Fatoum <ahmad.fatoum@siemens.com> Reviewed-on: https://code.wireshark.org/review/23113 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-07-03Add option to use wall-clock intervalsSake Blok1-4/+7
Add the "interval" option to "-b". Each new capture starts at the exact start of a time interval. For instance, using -b interval:3600 will start a new capture file at each whole hour. Changed the duration option in the GUI interfaces to use the new interval option. Change-Id: I0180c43843f5d2f0c2f50153c9ce42ac7fa5aeae Reviewed-on: https://code.wireshark.org/review/22428 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Sake Blok <sake.blok@SYN-bit.nl>
2017-03-28Reflect new default value of snaplen in man pages.Martin Sehnoutka1-1/+1
Default value for snaplen is defined in wiretap/wtap.h: #define WTAP_MAX_PACKET_SIZE 262144 and used in capture_opts.c: capture_opts->default_options.snaplen = WTAP_MAX_PACKET_SIZE; but help and man pages don't reflect this change. Change-Id: I35ddf1e8b7ffd657f4e01b3fe6b4c44c9acece2b Reviewed-on: https://code.wireshark.org/review/20738 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-12rpcap URLs *require* the :<port> argument for remote capture - update manpage.Joerg Mayer1-2/+2
Change-Id: Iabae39347bc0058d106a9b00d81629899bc93249 Reviewed-on: https://code.wireshark.org/review/20526 Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2016-10-04Man pages: Update -D flag text.Gerald Combs1-3/+3
Refer to "Windows" instead of "Windows 2000". Add an "ip link show" breadcrumb. Change-Id: Ie1faa1d30b0ac63de35b0385cbb1306f08828e61 Reviewed-on: https://code.wireshark.org/review/18056 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2016-01-27Allow/Create an option to use "capture filter" labels defined in wireshark ↵Mike781-0/+4
GUI from CLI Move ui/filters.[ch] to filter_files.[ch] because dumpcap is using functionality. Bug: 8091 Change-Id: I195c82fc023f97d6f331b8718c45a2d83d30faea Reviewed-on: https://code.wireshark.org/review/5925 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-03-10Change a lot of http:// URLs to https://.Gerald Combs1-1/+1
Most of our sites are now HTTPS-only. Update URLs accordingly. Update other URLs while we're at it. Remove or comment out dead links. Change-Id: I7c4f323e6585d22760bb90bf28fc0faa6b893a33 Reviewed-on: https://code.wireshark.org/review/7621 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2014-09-17Update the doc directory to use https://www.wireshark.org.Gerald Combs1-2/+2
Change-Id: I9bfc57cb6b6ab6962b80ff58d98eb351d6f69829 Reviewed-on: https://code.wireshark.org/review/4140 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2013-12-02Specify SI units for the max filesize autostop condition. For now, keep the ↵Chris Maynard1-7/+7
capture buffer size in IEC units, but document it as such. #BACKPORT(1.10, 1.8(?)) svn path=/trunk/; revision=53728
2013-08-29Handle the 2GiB boundary case of the max filesize autostop condition ↵Chris Maynard1-4/+4
properly so that we avoid overflow conditions and so that we ensure we don't capture more than 2GiB. Also, document the max filesize autostop value of 2GIB as well as indicating that it's truly GiB and not GB. This fixes the problem reported on ask: http://ask.wireshark.org/questions/23891/wireshark-wont-run-with-multiple-capture-files #BACKPORT(1.10) ... not sure about 1.8? svn path=/trunk/; revision=51576
2013-08-01add --capture-comment to tshark's manpageMartin Kaiser1-1/+1
fix a typo in the dumpcap manpage svn path=/trunk/; revision=51096
2013-07-28If a core Wireshark developer repeatedly can't remember that theGuy Harris1-7/+7
argument to the -F flag for pcap format is "libpcap", not "pcap", we have a problem. Make it "pcap", and add a backwards-compatibility hack to support using "libpcap" as well. Update the man pages to refer to it as pcap as well, and fix the capitalization of "WinPcap" (see http://www.winpcap.org) while we're at it. Also, refer to http://www.tcpdump.org/linktypes.html for the list of link-layer header types for pcap and pcap-ng. svn path=/trunk/; revision=50989
2013-07-27add --capture-comment to dumpcap's manpageMartin Kaiser1-0/+9
svn path=/trunk/; revision=50947
2013-06-24Dumpcap can write raw packets to stdoutBalint Reczey1-3/+1
svn path=/trunk/; revision=50126
2013-05-20If tcpdump doesn't exist, why refer to it? Omit this confusing phrase.Chris Maynard1-1/+1
svn path=/trunk/; revision=49427
2013-03-10Make the memory limit (in bytes or packets) used for storing packetsMichael Tüxen1-0/+16
configurable via command line options and print specific drop numbers at the end. This allows to tune the buffering when using multiple threads. This also fixes a logic arrow in enforcing the limits. The patch for the enhanced counters is from Anders Broman. svn path=/trunk/; revision=48223
2013-03-10Add -t to synopsis.Michael Tüxen1-0/+1
svn path=/trunk/; revision=48221
2013-02-28Default capture buffer size is now 2MB.Jeff Morriss1-2/+2
svn path=/trunk/; revision=47937
2013-02-03describe the -t option in the dumpcap manpageMartin Kaiser1-0/+4
(use the same text that dumpcap -V prints) svn path=/trunk/; revision=47455
2012-12-12Document the "-g" option to dumpcap.Jeff Morriss1-0/+7
Add that option to tshark, too, and document it. The option can't be given to Wireshark because the GUI already has a "-g" (goto packet). svn path=/trunk/; revision=46513
2012-06-08Some minimal documentation of remote capture interface formats for both ↵Chris Maynard1-2/+2
rpcap and the new TCP feature from bug 2788. svn path=/trunk/; revision=43156
2012-05-12From r37696 default file format for dumpcap is pcap-ng. Fix manuals.Jakub Zawadzki1-4/+3
svn path=/trunk/; revision=42600
2012-03-15Correct the sorting of the options in the synopsis.Chris Maynard1-1/+1
svn path=/trunk/; revision=41564
2012-02-03The libpcap puts pcap-filter into the misc section (which seems to be 7).Jörg Mayer1-3/+3
Refer to pcap-filter and mention tcpdump only as a fallback. svn path=/trunk/; revision=40820
2011-09-23The -D, -L and -S options are mutually exclusive, so change "and" to "or".Chris Maynard1-1/+1
svn path=/trunk/; revision=39113
2011-06-28Document the handling of command line parameters with respect toMichael Tüxen1-0/+44
the capturing on multiple interfaces. svn path=/trunk/; revision=37824
2011-06-17Make pcap-ng the default. Add a compile-time option to prefer pcap-ng orGerald Combs1-2/+8
pcap. Add a "-P" capture option which tries to use pcap instead of pcap-ng ("-P" seemed to be the best option but we may want to use a different letter). Update the documentation and release notes. svn path=/trunk/; revision=37696
2010-11-27From OKANO Takayoshi via bug #5442: Fix typos in documentationStephen Fisher1-1/+1
svn path=/trunk/; revision=35038
2010-07-13Add a "-d" flag to dumpcap, to print out the generated code for theGuy Harris1-0/+6
capture filter in human-readable form. (Well, readable by humans who know BPF machine language, at least. :-)) svn path=/trunk/; revision=33509
2010-05-27Document the maximum number of files in a ring buffer, including a warning ↵Jeff Morriss1-11/+19
about using large numbers of files. svn path=/trunk/; revision=32999
2010-05-26Add a -q flag to dumpcap, to squelch its reporting of the packet count,Guy Harris1-0/+12
and add support for SIGINFO, so, if your OS supports SIGINFO, you can get the packet count by typing ^T. svn path=/trunk/; revision=32958
2010-05-19Don't have -M affect -v yet; if we end up, for example, having dumpcapGuy Harris1-9/+3
being the only program that needs to be linked with *pcap, that's when we'd want to fetch that information, but there might be other libraries (e.g., the POSIX capabilities library) that it might be linked with but that programs that use it aren't linked with. Don't commit to the output formats of -M, as they are, as noted, subject to change from release to release. svn path=/trunk/; revision=32904
2010-05-18Don't write the SP_SUCCESS messages unless -Z was specified.Guy Harris1-2/+11
Add support for a machine-readable "-v" output, which prints only the pcap version string. Give a little more information about the machine-readable format, but note that it's primarily intended for consumption by Wireshark and TShark and is subject to change. Properly hyphenate "pcap-ng". svn path=/trunk/; revision=32851
2010-05-08The default capture buffer size is, in fact, *nominally* 1MB; however,Guy Harris1-4/+7
libpcap/WinPcap and the capture mechanism atop which they run might either silently limit the buffer size to a smaller value or raise it to a higher value - that's the part that's platform-dependent. svn path=/trunk/; revision=32718
2010-05-07-B is no longer Windows-only.Guy Harris1-5/+10
svn path=/trunk/; revision=32707
2010-05-07Beginnings of monitor mode support with libpcap 1.x.Guy Harris1-0/+13
svn path=/trunk/; revision=32702
2010-04-09As requested in:Jeff Morriss1-1/+2
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2132 Point to the Wiki's page on capture filter syntax in case neither libpcap's nor tcpdump's man pages are available (e.g., on Windows). svn path=/trunk/; revision=32435
2010-03-19Clarify that "-b" with the "files" criterion needs either duration or filesizeJeff Morriss1-36/+39
to be set. Clarify that each "-b" criterion needs the "-b" option (see bug 4573). Fix a couple of typos. svn path=/trunk/; revision=32245
2009-05-12SYNOPSYS --> SYNOPSISBill Meier1-1/+1
svn path=/trunk/; revision=28338
2009-05-12Update man pages; Add several missing options; Fix typos, Do minor rewording; Bill Meier1-1/+6
editcap: Add description of -i option; dumpcap: Add description of -S option; svn path=/trunk/; revision=28336
2009-04-27Add -n option to dumpcap. It will save the capture files inMichael Tüxen1-0/+7
pcapng format instead of pcap. The default is to use pcap. svn path=/trunk/; revision=28170
2009-02-23Have the minimum snapshot length be 1 byte, and have a snapshot lengthGuy Harris1-1/+2
of 0 mean 65535, similar to what tcpdump does. Fixes bug 2731. svn path=/trunk/; revision=27526
2008-01-07The syntax for capture filters has been moved fromJörg Mayer1-3/+3
tcpdump (in the tcpdump package) into its own manpage (pcap-filter) in the libpcap package in the CVS HEAD branch. Reference the new and the old location for that information. svn path=/trunk/; revision=24020
2007-07-20Remove the "-I" flag from dumpcap, and add a "-M" flag used to specifyGerald Combs1-9/+5
that "-D" and "-L" should produce machine-readable output. Use this to move an indirect get_pcap_linktype() call from the GUI to dumpcap. svn path=/trunk/; revision=22367
2007-06-11One more step in privilege separation.Gerald Combs1-0/+9
Add a capture_interface_list(), which works similar to get_interface_list() except that it forks dumpcap instead of calling the pcap routines directly. Use it in the GUI. Add a "-I" flag to dumpcap, which prints out verbose interface information. Tested under Windows and Linux. svn path=/trunk/; revision=22071
2006-08-10Add some programs to 'see also'Jörg Mayer1-1/+2
svn path=/trunk/; revision=18867
2006-07-09Use L<> on all links.Guy Harris1-4/+4
Don't use anything on man page references - pod2man handles that. Don't refer to "the capture file format section" of the Wireshark man page, as there's no section explicitly labelled as such; just refer to the beginning of the DESCRIPTION section. svn path=/trunk/; revision=18694
2006-05-31Rename the main executable to "wireshark", along with more conversions:Gerald Combs1-7/+7
ethereal.com -> wireshark.org mailing lists and addresses ETHEREAL -> WIRESHARK Man pages Automake/Autoconf names svn path=/trunk/; revision=18271
2006-05-31Tethereal/tethereal -> TShark/tshark.Gerald Combs1-1/+1
svn path=/trunk/; revision=18268
2006-05-22ethereal->wiresharkRonnie Sahlberg1-1/+1
svn path=/trunk/; revision=18207
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-26 11:33:53 +0000