5

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark.

Is there any solution?

christophrus
  • 181

2 Answers2

5

You can use the following:

tail -f -c +0 foo.pcap | wireshark -k -i -

With:

  • tail -f -c +0: Feed the capture file to wireshark
  • -k: Start the capture session immediately
  • -i -: Capture from STDIN

Reference: Wireshark feeding from stdin

Gohu
  • 1,029
1

Yes, there is pcaptail which does exactly that (direct download).

Adrian Frühwirth
  • 781