We are running offline network analysis by capturing packets to files and analyzing afterwards with automated system.
Our Wireshark @ Ubunty command line looks like:
wireshark -k -i eth0 -y EN10MB -b duration:900 -b filesize:1024 -n -w /home/mss2/Capture/packets/ubuntlive1mb -f 'ip and (net X.X.X.X/22)'
A week ago traffic increased twice in volume so we have drive space issues. As a temporarily solution we are deleting every second file as this will not affect overall stats (percentages of traffic types) that bad.
I wonder is there the way to tell wireshark (or maybe other program?) to capture not all by every second packet?