User Guide

Customizing Wireshark
149
-p Don't put the interface into promiscuous mode. Note that the
interface might be in promiscuous mode for some other reason;
hence, -p cannot be used to ensure that the only traffic that is
captured is traffic sent to or from the machine on which Wireshark
is running, broadcast traffic, and multicast traffic to addresses
received by that machine.
-P <path setting> Special path settings usually detected automatically. This is used
for special cases, e.g. starting Wireshark from a known location on
an USB stick.
The criterion is of the form key:path, where key is one of:
persconf:path path of personal configuration files, like the
preferences files.
persdata:path path of personal data files, it's the folder
initially opened. After the initialization, the
recent file will keep the folder last used.
-Q This option forces Wireshark to exit when capturing is complete. It
can be used with the -c option. It must be used in conjunction with
the -i and -w options.
-r <infile> This option provides the name of a capture file for Wireshark to read
and display. This capture file can be in one of the formats Wireshark
understands.
-R <read (display) filter> This option specifies a display filter to be applied when reading
packets from a capture file. The syntax of this filter is that of the
display filters discussed in Section 6.3, “Filtering packets while
viewing”. Packets not matching the filter are discarded.
-s <capture snaplen> This option specifies the snapshot length to use when capturing
packets. Wireshark will only capture <snaplen> bytes of data for
each packet.
-S This option specifies that Wireshark will display packets as it
captures them. This is done by capturing in one process and
displaying them in a separate process. This is the same as "Update
list of packets in real time" in the Capture Options dialog box.
-t <time stamp format> This option sets the format of packet timestamps that are displayed
in the packet list window. The format can be one of:
• r relative, which specifies timestamps are displayed relative to
the first packet captured.
• a absolute, which specifies that actual times be displayed for all
packets.
• ad absolute with date, which specifies that actual dates and times
be displayed for all packets.
• d delta, which specifies that timestamps are relative to the
previous packet.