'06:36:05.109737000','10.2.3.5','192.168.0.3','IN s1/tmm1 : NTP Version 3, client'īreaking down that command line we have: Optionĭisplay filter to select what packets to showīut where does one find out the field name for the desired field? Such an example command line might look like: $ tshark.exe -r -2 -R 'ip.addr=10.2.3.5' -T fields -E separator=, -E quote=d -e frame.time -e ip.src -e ip.dst -e _ws.col.Info Just as you can configure what columns to display in the packet summary in Wireshark – you can tell TShark what fields to display from the command line. In this case the TShark tool is very useful. Provide the collected capture to Acronis Support.Sometimes you want to process packet captures from the command line rather than from Wireshark’s GUI. This doesn't affect the capture file in any way.Ħ. On a failed backup the post-backup command will not start which means you will need to kill the wireshark.exe manually.

On a successful backup the pre-backup command will end with a failure, this is expected because we forcefully kill the process. Uncheck all Fail the backup if command execution fails and Don't start optionsĥ.

taskkill /im 'wireshark.exe' /F is to make sure the wireshark process is killed after the backup succeeds - to avoid spawning multiple unneeded processes.Ĥ.

specify the target file name for capture in '-w' parameter, e.g.

Specify a duration at which the backup usually fails in seconds (60 for 1 minute, 900 for 15 minutes and so on - the larger the value, the larger the log).

' -a duration:60' is to ensure the capture stops after 60 seconds and doesn't continue in case the backup runs for longer.

name of the interface for the ' -i' parameter can be defined through ' wireshark -D' command or by running Wireshark and noting the interface name in the GUI.

Make sure to adjust the working folder to the one noted at step 2.

Create a pre-backup and post-backup commands as specified on the attached screenshot.

Note the installation folder with the executable, e.g.

Download the free Wireshark utility from and install Wireshark on the device.

in case scheduled backup to Acronis Cloud fails.įor general instructions on using Wireshark see Collecting PCAP Logs with Wireshark Solution This article describes how to capture Wireshark logs on scheduled backups in Windows, e.g.

Tshark commands