Just capture files with 100MB each:
[sourcecode]
tshark -i eth2 -b filesize:100000 -w eth2_smtp.pcap -s 0 -R "smtp"
[/sourcecode]
If you feel this helps a bit or may be not ? Please leave a comment.
Just capture files with 100MB each:
[sourcecode]
tshark -i eth2 -b filesize:100000 -w eth2_smtp.pcap -s 0 -R "smtp"
[/sourcecode]
If you feel this helps a bit or may be not ? Please leave a comment.