One of the advantages of installing Wireshark, is working with and learning the various command line utilities that come along with it. Programs like tshark and dumpcap allow you to capture from the command line. This gives the analyst a lot of flexibility in the field.
For example, you might create a shortcut on a client’s desktop so they can capture packets for you. You can also create a batch file so the system starts capturing when it powered on, which is very helpful when I build remote capture devices.
Tshark and dumpcap can capture with specific parameters like ring buffers, filters, etc.
One popular question I get asked is how to stop dumpcap or tshark after you start it. Normally you would press Ctrl+C to stop the capture. I have to admit that the solution I came up with, is not very elegant, but works.
This solution works with Windows 7, 8, 10 and 11. The commands referenced tasklist and taskkill. By ‘killing either tshark or dumpcap, the capture is halted and since the file is written to as the packets are captured, the trace file is saved.
Here is a list of commands I used:
dumpcap –D
Provides a list of interfaces to reference when capturing
dumpcap -i 8
Captures from interface number 8 using the default temp folder and filename.
Captures from interface number 8 using the default temp folder and filename.
tasklist /FI "imagename eq dumpcap.exe"
Will check and display related information the dumpcap.exe is running.
Will check and display related information the dumpcap.exe is running.
taskkill /F /IM dumpcap.exe
Will kill the dumpcap.exe task or application.
The best part is that if you have the proper login credentials, you can perform the same procedure on a remote system.
Will kill the dumpcap.exe task or application.
The best part is that if you have the proper login credentials, you can perform the same procedure on a remote system.
Tony Fortunato is a Senior Network Performance Specialist and founder of The Technology Firm, where he has been designing, implementing, and troubleshooting computer networks since 1989. His company specializes in customized onsite and remote training, live network troubleshooting, packet analysis, and mentoring, helping organizations improve both their network performance and the skills of their technical staff. Tony has taught thousands of IT professionals at colleges, universities, industry conferences, and private training sessions, with expertise spanning Wireshark, NetAlly tools, Microsoft networking, wireless technologies, and open-source network analysis utilities. He is also a prolific technical author and content creator, publishing hundreds of networking articles, producing educational YouTube videos, and contributing to publications such as NetworkDataPedia, NetAlly, and Network Computing. Throughout his career, he has built a reputation for practical, hands-on troubleshooting, emphasizing methodology, knowledge transfer, and real-world solutions over simply fixing individual problems.
