1

I'm bit new to Unix and wanted to ask for quick code I can use to repeat tshark command each 60 sec,

the command I want to run is something like:

 tshark -z io,stat,1,tcp.port==80,tcp.port==443 -a duration:60  > filename.txt

I need to put this command in a loop to re run each 60 sec, and each time change the output file name preferably use the time and date for naming files or easier use a number stepping counter for naming the files.

any suggestions ?

Thanks

2 Answers 2

3

Since the command you posted already takes about 60 seconds to run, perhaps something like the following would do:

while true; do tshark ... > "tshark-$(date +%F-%T).txt"; done

This will produce file names such as tshark-2017-02-16-11:44:22.txt.

0
1

Note that if you repeat that command in a loop, you're going to miss the packets that are transmitted between the time one tshark closes and the next tshark starts and is ready to capture packets.

Maybe a better approach would be to use dumpcap once and tell it to generate a new file every minute. And then, get the statistics from those dumps when needed. With raw dump files, you'd be able to get all possible information out of it.

Something like:

dumpcap -b duration:60 -w dump.pcap

Which would create files named like dump_00002_20170224130408.pcap.

And then get the statistics, if needed with:

tshark -z io,stat,1,tcp.port==80,tcp.port==443 -r dump_00002_20170224130408.pcap

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .