Posted this on network engineering earlier: https://networkengineering.stackexchange.com/questions/67433/realtime-filtering-of-a-recording-in-a-different-process
I have a network recording setup which outputs the capture in ERF format. While I record this, I also want to filter this capture into several smaller files. Is there any way to filter the recording as it is being generated? I have tried using the following
tail -f -n +1 <capture file> | tshark -F erf -i - -Y <filter1> -w <output file1>
but this results in following error
tshark: Live captures can only be saved in pcap or pcapng format.
