虽然进程仍在运行，但在几分钟后就停止了捕获。

Question

我已经构建了开始使用命令行捕获的.Net应用程序

  private void startCapturing(string path)
    {
        string args = string.Format("-i 1 -s 65535 -w {0}", Path.Combine(@"D:\Downloads", path));
    }

protected void invokeProcess(WiresharkProcesses process, string args)
{
    try
    {
        string processToInvoke = null;
        validateProcess(process);

        switch (process)
        {
            case WiresharkProcesses.Capinfo:
                processToInvoke = Path.Combine(getbBasePath, "capinfos.exe");
                break;
            case WiresharkProcesses.Editcap:
                processToInvoke = Path.Combine(getbBasePath, "editcap.exe");
                break;
            case WiresharkProcesses.Tshark:
                processToInvoke = Path.Combine(getbBasePath, "tshark.exe");
                break;
            case WiresharkProcesses.Wireshark:
                processToInvoke = Path.Combine(getbBasePath, "wireshark.exe");
                break;
        }

        ProcessStartInfo processStartInfo = new ProcessStartInfo(processToInvoke);
        processStartInfo.Arguments = args;
        processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
        processStartInfo.RedirectStandardOutput = true;
        processStartInfo.RedirectStandardError = true;
        processStartInfo.CreateNoWindow = true;
        processStartInfo.UseShellExecute = false;
        processStartInfo.ErrorDialog = false;
        Process pros = Process.Start(processStartInfo);
    }
    catch (Exception ex)
    {
        cw(ex.Message);
    }
}

一切正常，但几分钟后(当thark进程仍在运行时)，我可以看到没有接收到新的数据包(我只是打开磁盘上的捕获)和运行时间(统计->摘要)没有增长。

如果我使用的是同一个命令，但直接来自命令行(没有.Net代码)，那么它可以不间断地工作。顺便说一下，我的wireshark版本在Windows 8 x64下是1.10.0

Answer 1

可能是因为你没有收到那么多的数据包，而tshark正在缓冲它们。所以它看起来好像有一段时间不捕获了。为了确保tshark不缓冲数据包：

tshark -l

从手册页：

-l  Flush the standard output after the information for each packet is printed. 
    [...]

    This may be useful when piping the output of TShark to another program, as it
    means that the program to which the output is piped will see the dissected
    data for a packet as soon as TShark sees the packet and generates that
    output, rather than seeing it only when the standard output buffer containing
    that data fills up.