Remotely or Automatically Stopping Your Wireshark Capture HD

more at www.thetechfirm.com One of the advantages of installing Wireshark, is working with and learning the various command line utilities that come along with it. Programs like tshark and dumpcap allow you to capture from the command line. This gives the analyst a lot of flexibility in the field. For example you might create a shortcut on a client’s desktop so they can capture packets for you. You can also create a batch file so the system starts capturing when it powered on, which is very helpful when I build remote capture devices. Tshark and dumpcap can capture with specific parameters like ring buffers, filters, etc. One popular question I get asked is how to stop dumpcap or tshark after you start it. Normally you would press Ctrl+C to stop the capture. I have to admit that the solution I came up with is not very elegant, but works. read the full article at https://www.lovemytool.com/blog/tony-fortunato/ when its posted