From dd884611ac69f1c671bf11a8c57267dd629fd803 Mon Sep 17 00:00:00 2001 From: Hessam Jalali Date: Mon, 24 Apr 2017 17:31:00 +0430 Subject: Auto reset epan session Automatically resets intarnal epan session after reaching to specified number of packets, for example -M 1000 will reset the session every 1000 packets. this is more like a proposal since the usage is very specific it is useful for 24/7 live capture with dissection and sending data directly to another application. example: tshark -Y "gtp" -M 100000 -T fields -e gtp.message -e gtp.teid Change-Id: I8ee8b0380017c684120a93cb3fb43f41615a9c04 Reviewed-on: https://code.wireshark.org/review/21312 Reviewed-by: Evan Huus Petri-Dish: Evan Huus Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann --- doc/tshark.pod | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'doc/tshark.pod') diff --git a/doc/tshark.pod b/doc/tshark.pod index 100049609d..e6034f64ac 100644 --- a/doc/tshark.pod +++ b/doc/tshark.pod @@ -51,6 +51,7 @@ S<[ B<-x> ]> S<[ B<-X> EeXtension optionE]> S<[ B<-y> Ecapture link typeE ]> S<[ B<-Y> EdisplaY filterE ]> +S<[ B<-M> Eauto session resetE ]> S<[ B<-z> EstatisticsE ]> S<[ B<--capture-comment> EcommentE ]> S<[ B<--export-objects> EprotocolE,EdestdirE ]> @@ -904,6 +905,17 @@ Use this instead of -R for filtering using single-pass analysis. If doing two-pass analysis (see -2) then only packets matching the read filter (if there is one) will be checked against this filter. +=item -M Eauto session resetE + +Automatically reset internal session when reached to specified number of packets. +for example, + + -M 100000 + +will reset session every 100000 packets. + +This feature does not support -2 two-pass analysis + =item -z EstatisticsE Get B to collect various types of statistics and display the result -- cgit v1.2.3