Dumpcap doesn't support a -Q flag

This issue was migrated from bug 14491 in our old bug tracker.

Original bug information:

Reporter: Avi
Status: CONFIRMED
Product: Wireshark
Component: Dumpcap
OS: All
Platform: All
Version: Git

Avi said:

Build Information: C:\Program Files (x86)\Wireshark>"C:\Program Files (x86)\Wireshark\dumpcap.exe" -h Dumpcap (Wireshark) 2.4.2 (v2.4.2-0-gb6c63ae086) Capture network packets and dump them into a pcapng or pcap file. See https://www.wireshark.org for more information.

Usage: dumpcap [options] ...

C:\Program Files (x86)\Wireshark>"C:\Program Files (x86)\Wireshark\tshark.exe" -h TShark (Wireshark) 2.4.2 (v2.4.2-0-gb6c63ae086) Dump and analyze network traffic. See https://www.wireshark.org for more information.

Usage: tshark [options] ...

---

Dear reader,

grahamb answered:
Dumpcap doesn't support a -Q flag, hence the error. Adding support to dumpcap for that would require an Enhancement request on the Wireshark Bugzilla.

My question was:
I used the following line for getting the results in text file and it works fine. i.e. No notification messages in the error channel.

"C:\Program Files (x86)\Wireshark\tshark.exe" -Q -P -i 4 -Y "ip.dst==172.17.231.50&&icmp" -V -S 5%%%5 > C:\temp\output.txt

When trying to get the results in a pcap file, I received notification messages in the error channel.

"C:\\Program Files (x86)\\Wireshark\\dumpcap.exe" -i 4 -w - | "C:\\Program Files (x86)\\Wireshark\\tshark.exe" -Q -P -r - -Y "ip.dst==172.17.231.50&&icmp" -w "C:\\temp\\output.pcap"

Trying to add –P –Q to the first part yielded an error message saying: “C:\Program Files (x86)\Wireshark\dumpcap.exe: invalid option -- 'Q'”

"C:\Program Files (x86)\Wireshark\dumpcap.exe" -Q -P -i 4 -w - | "C:\Program Files (x86)\Wireshark\tshark.exe" -Q -P -r - -Y "ip.dst==172.17.231.50&&icmp" -w "C:\temp\output.pcap"
C:\Program Files (x86)\Wireshark\dumpcap.exe: invalid option -- 'Q'

Is there a proper way of getting the captured packets into a pcap file without any notification messages in the error channel?

(The double backslash is because I’m activating the command with python)

added clidumpcap enhancement versiondev labels

Christopher Maynard said:

I believe this bug report is an enhancement request for the -Q option to be implemented for dumpcap the same as it is implemented for tshark, so I've re-categorized the bug to reflect this.

mentioned in merge request !15902 (merged)

closed with commit fab6e005

closed with merge request !15902 (merged)