Could you tell me how I can start to capture packets with specific interface by command line and saving it by command line using Wireshark? I would like to save it on my Desktop.
OS X 10.9.2
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
tshark utility is included with wireshark for this purpose.
tshark -i en1 -w ~/Desktop/packet_capture_file.cap
You can also start
tcpdump from a command line, and then open the resulting
.pcap file in Wireshark's GUI
sudo tcpdump -i en1 -s 0 -B 524288 -w ~/Desktop/packet_capture_file.pcap
Both of those commands will start a capture of the interface
en1 and write the output to
packet_capture_file.pcap on your desktop.