-a <capture autostop condition>
Specify a criterion that specifies when Wireshark is to stop writing
to a capture file. The criterion is of the form test:value, where test
is one of:
Stop writing to a capture file after value of seconds have elapsed.
Stop writing to a capture file after it reaches a size of value
kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes). If
this option is used together with the -b option, Wireshark will
stop writing to the current capture file and switch to the next
one if filesize is reached.
Stop writing to capture files after value number of files were
-b <capture ring buffer option>
If a maximum capture file size was specified, this option causes Wireshark to run
in "ring buffer" mode, with the specified number of files. In "ring
buffer" mode, Wireshark will write to several capture files. Their
name is based on the number of the file and on the creation date and
When the first capture file fills up, Wireshark will switch to writing
to the next file, until it fills up the last file, at which point
it'll discard the data in the first file (unless 0 is specified, in
which case, the number of files is unlimited) and start writing to
that file and so on.
If the optional duration is specified, Wireshark will also switch to
the next file when the specified number of seconds has elapsed even
if the current file is not completely fills up.
Switch to the next file after value seconds have elapsed, even
if the current file is not completely filled up.
Switch to the next file after it reaches a size of value kilobytes
(where a kilobyte is 1000 bytes, not 1024 bytes).
Begin again with the first file after value number of files were
written (form a ring buffer).
-B <capture buffer size (Win32 only)>
Win32 only: set capture buffer size (in MB, default is 1MB). This
is used by the the capture driver to buffer packet data until that
data can be written to disk. If you encounter packet drops while
capturing, try to increase this size.
-c <capture packet count>
This option specifies the maximum number of packets to capture
when capturing live data. It would be used in conjunction
Print a list of the interfaces on which Wireshark can capture, and
exit. For each network interface, a number and an
interface name, possibly followed by a text description of the
interface, is printed. The interface name or the number can be supplied
flag to specify an interface on which to capture.
This can be useful on systems that don't have a command to list them
(e.g., Windows systems, or UNIX systems lacking
the number can be useful on Windows 2000 and later systems, where the
interface name is a somewhat complex string.
Note that "can capture" means that Wireshark was able to open
that device to do a live capture; if, on your system, a program doing a
network capture must be run from an account with special privileges (for
example, as root), then, if Wireshark is run with the
is not run from such an account, it will not list any interfaces.
-f <capture filter>
This option sets the initial capture filter expression to
be used when capturing packets.
-g <packet number>
After reading in a capture file using the -r flag, go to the given
option requests Wireshark to print
its version and usage instructions (as shown above) and exit.
-i <capture interface>
Set the name of the network interface or pipe to use for live packet
Network interface names should match one of the names listed in
(described above); a number, as reported by
, can also be used. If you're using UNIX,
might also work to list interface names,
although not all versions of UNIX support the
If no interface is specified, Wireshark searches the list of
interfaces, choosing the first non-loopback interface if there are any
non-loopback interfaces, and choosing the first loopback interface if
there are no non-loopback interfaces; if there are no interfaces,
Wireshark reports an error and doesn't start the capture.
Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
read data from the standard input. Data read from pipes must be in
standard libpcap format.
option specifies that Wireshark
should start capturing packets immediately. This option
requires the use of the
specify the interface that packet capture will occur from.
This option turns on automatic scrolling if the packet
list pane is being updated automatically as packets arrive
during a capture ( as specified by the
List the data link types supported by the interface and exit.
This option sets the name of the font used for most text
displayed by Wireshark. XXX - add an example!
Disable network object name resolution (such as hostname, TCP and UDP
-N <name resolving flags>
Turns on name resolving for particular types of addresses
and port numbers; the argument is a string that may contain
to enable MAC address
to enable network address
to enable transport-layer
port number resolution. This overrides
present. The letter C enables concurrent (asynchronous) DNS lookups.
-o <preference/recent settings>
Sets a preference or recent value, overriding the default value and
any value read from a preference/recent file. The argument to the
flag is a string of the form prefname:value, where prefname
is the name of the preference (which is the same name that
would appear in the preference/recent file), and value is the value
to which it should be set. Multiple instances of
-o <preference settings>
given on a single command line.
An example of setting a single preference would be:
wireshark -o mgcp.display_dissect_tree:TRUE
An example of setting multiple preferences would be:
wireshark -o mgcp.display_dissect_tree:TRUE -o mgcp.udp.callagent_port:2627
User access tables can be overridden using "uat," followed by
the UAT file name and a valid record for the file:
wireshark -o "uat:user_dlts:\"User 0 (DLT=147)\",\"http\",\"0\",\"\",\"0\",\"\""
The example above would dissect packets with a libpcap data
link type 147 as HTTP, just as if you had configured it in the
DLT_USER protocol preferences.
Don't put the interface into promiscuous mode. Note that
the interface might be in promiscuous mode for some other
reason; hence, -p cannot be used to ensure that the only
traffic that is captured is traffic sent to or from the
machine on which Wireshark is running, broadcast traffic, and
multicast traffic to addresses received by that machine.
-P <path setting>
Special path settings usually detected automatically. This is used
for special cases, e.g. starting Wireshark from a known location on
an USB stick.
The criterion is of the form key:path, where key is one of:
path of personal configuration files, like the preferences files.
path of personal data files, it's the folder initially opened.
After the initialization, the recent file will keep the folder
This option forces Wireshark to exit when capturing is
complete. It can be used with the
It must be used in conjunction with the
This option provides the name of a capture file for Wireshark
to read and display. This capture file can be in one of the
formats Wireshark understands.
-R <read (display) filter>
This option specifies a display filter to be applied when
reading packets from a capture file. The syntax of this
filter is that of the display filters discussed in
Section 6.3, “Filtering packets while viewing”. Packets not
matching the filter are discarded.
-s <capture snaplen>
This option specifies the snapshot length to use when
capturing packets. Wireshark will only capture
bytes of data for each packet.
This option specifies that Wireshark will display packets as
it captures them. This is done by capturing in one process
and displaying them in a separate process. This is the same
as "Update list of packets in real time" in the Capture Options
-t <time stamp format>
This option sets the format of packet timestamps that are
displayed in the packet list window. The format can be one of:
relative, which specifies timestamps are
displayed relative to the first packet captured.
absolute, which specifies that actual times
be displayed for all packets.
absolute with date, which specifies that
actual dates and times be displayed for all packets.
delta, which specifies that timestamps
are relative to the previous packet.
epoch, which specifies that timestamps
are seconds since epoch (Jan 1, 1970 00:00:00)
Wireshark to print out its version information and exit.
This option sets the name of the
to be used when saving a capture file.
-y <capture link type>
If a capture is started from the command line with -k, set the data
link type to use while capturing packets. The values reported by -L
are the values that can be used.
-X <eXtension option>
Specify an option to be passed to a TShark module. The eXtension
option is in the form extension_key:value, where extension_key can
:lua_script_filename; Tells Wireshark to load the given script in addition to the default Lua scripts.
Get Wireshark to collect various types of statistics and display the
result in a window that updates in semi-real time.
XXX - add more details here!