I strongly recommend testing your configuration before scheduling or going live with any configuration and to use ring buffers for long-term capture. In this video, I show how to get started with DumpcapUI. This portable utility allows you to configure some of the more common dumpcap features using a GUI interface and configure a task in your Microsoft Scheduler. I can safely say that when performance is a concern, dumpcap is the clear winner. There has always been quite a debate over Tshark and dumpcap.

The problem with the first option is that if anything on the screen is repositioned, the script will fail.

Use the dumpcap Wireshark tool and a scheduling program.

Use the Tshark Wireshark utility and a scheduling program.

Write a script or macro that will navigate around the screen’s GUI and start/stop the capture.

There are three ways to approach this with Wireshark: One of the tricky things about troubleshooting with network protocol analysis is getting comfortable with unattended capture when you need to start a capture at a specific time.

Wireshark captures find in packet