tshark 抓包常有操作:
tshark -i eth0 -s 2000 -w beitong_20130117.sip.pcap -b:100 -a filesize:102400 port 5060
tshark -i eth0 -s 2000 -w beitong_20130117.sip.pcap -b:100 -a filesize:102400 udp
-b 轮转次数
filesize:抓包大小 单位为K
tshark -i eth0 -s 2000 -w beitong_20130117.sip.pcap -b:100 -a filesize:102400 port 5060
tshark -i eth0 -s 2000 -w beitong_20130117.sip.pcap -b:100 -a filesize:102400 udp
-b 轮转次数
filesize:抓包大小 单位为K