Wireshark命令行应用

    Wireshark命令行应用

典型案例：

c:\Program Files\Wireshark>Wireshark -i 1 -k -t ad -b duration:600  -w d:\cc

可实现自动启动Wireshark 程序，定时形成一个抓包文件。

命令行参数：

Capture interface:
  -i <interface>            name or idx of interface (def: first non-loopback)
  -f <capture filter>      packet filter in libpcap filter syntax
  -s <snaplen>             packet snapshot length (def: 65535)
  -p                        don't capture in promiscuous mode
  -k                        start capturing immediately (def: do nothing)
  -S                       update packet display when new packets are captured
  -l                          turn on automatic scrolling while -S is in use
  -B <buffer size>         size of kernel buffer (def: 2MB)
  -y <link type>             link layer type (def: first appropriate)
  -D                       print list of interfaces and exit
  -L                       print list of link-layer types of iface and exit

Capture stop conditions:
  -c <packet count>          stop after n packets (def: infinite)
  -a <autostop cond.> ...  duration:NUM - stop after NUM seconds
                                          filesize:NUM - stop this file after NUM KB
                                          files:NUM - stop after NUM files
Capture output:
  -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
                              filesize:NUM - switch to next file after NUM KB
                              files:NUM - ringbuffer: replace after NUM files
RPCAP options:
  -A <user>:<password>     use RPCAP password authentication
Input file:
  -r <infile>              set the filename to read from (no pipes or stdin!)

Processing:
  -R <read filter>         packet filter in Wireshark display filter syntax
  -n                       disable all name resolutions (def: all enabled)
  -N <name resolve flags>  enable specific name resolution(s): "mntC"

User interface:
  -C <config profile>      start with specified configuration profile
  -Y <display filter>      start with the given display filter
  -g <packet number>       go to specified packet number after "-r"
  -J <jump filter>         jump to the first packet matching the (display)
                           filter
  -j                       search backwards for a matching packet after "-J"
  -m <font>                set the font name used for most text
  -t a|ad|d|dd|e|r|u|ud    output format of time stamps (def: r: rel. to first)
  -u s|hms                 output format of seconds (def: s: seconds)
  -X <key>:<value>         eXtension options, see man page for details
  -z <statistics>          show various statistics, see man page for details

Output:
  -w <outfile|->           set the output filename (or '-' for stdout)

Miscellaneous:
  -h                       display this help and exit
  -v                       display version info and exit
  -P <key>:<path>          persconf:path - personal configuration files
                           persdata:path - personal data files
  -o <name>:<value> ...    override preference or recent setting
  -K <keytab>              keytab file to use for kerberos decryption

详细中文介绍可参照：http://man.lupaworld.com/content/network/wireshark/c9.2.html

补充tcpdump用法： 

#tcpdump -i eth0 -tttt -c 100 dst 8.8.8.8 and port 53 -w dns.pcapng