Stop a Live Capture

[RomainLaniece]

Hi,

I just start with pyshark, and try to get a living capture. Here is the basic commands I use :

import pyshark
capture = pyshark.LiveCapture(interface='eth0')
capture.sniff(timeout=5)

By doing this, I get a capture of 5 seconds, that's ok.
The only problem I have, is that tshark continues to run in background, and doesn't stop to fill a temporary file in /tmp/ (named wireshark_pcapng_eth0_* with * the date and a sort of id).

The only way I have, to stop the tshark binary, is to stop my python script execution, but the tmp files are still existing.

So my question are :

• is it the normal behaviour ?
• is it possible to capture xxx seconds of a living stream, then stop tshark and remove the temporary file by using the pyshark library ?

Thanks,

Romain.

[llchen223]

tshark is creating the temp file. I worked around this by using a ring buffer to tshark params:
"-b filesize:1024 -b files:1 -w /tmp/pyshark.pcap -P"

This will output to stdout and save to a 1MB temp file.

You'll probably need to branch pyshark and change the subprocess parameters.

[RemiDesgrange]

Hi, @llchen223 what do you mean by "branch pyshark and change the subprocess parameters" ?

thanks

[llchen223]

I mean you will need to modify the pyshark source code yourself with what I
specified above.
On Nov 16, 2015 1:24 AM, "Rémi Desgrange" notifications@github.com wrote:

Hi, @llchen223 https://github.com/llchen223 what do you mean by "branch
pyshark and change the subprocess parameters" ?

thanks

—
Reply to this email directly or view it on GitHub
#92 (comment).

[RemiDesgrange]

That's what I thought. I'm going to change that if I can and will do a pull request if it's good enough, thanks anyway.

[KimiNewt]

You can also subclass LiveCapture and override the get_parameters() function, adding your own parameters. If you can do a PR with a function for setting extra parameters I will improve it (apologies for not fixing things myself, v. busy atm).

[RemiDesgrange]

I'm pretty busy right now, but maybe I'll later. But instead of kill tshark with a async coroutine or I-don't-know-what-sort-of-complicated-things. You can just pass -a duration:XX where is XX is second.

[llchen223]

I made PR. thanks

On Tue, Nov 17, 2015 at 12:50 AM, Dor Green notifications@github.com
wrote:

You can also subclass LiveCapture and override the get_parameters()
function, adding your own parameters. If you can do a PR with a function
for setting extra parameters I will improve it (apologies for not fixing
things myself, v. busy atm).

—
Reply to this email directly or view it on GitHub
#92 (comment).

[RomainLaniece]

Hi,
Nearly 4 years I opened this one, I guess I can close it now.
Best Regards.

[Tsajan]

How do I fix this issue? Packet count or limit doesn't seem to be working