3

I'm capturing packets on a specific channel using "airport" command on Mac OS X Sierra. The command saves the packets into a *.cap file in my tmp folder. The file is already almost 2 GB large. What I would like to do is to pause the capturing process and then be able to continue to capture on the same channel and into the same *.cap file. I'm afraid to just abort the command in Terminal using CTRL+C because then after rerunning the command I suspect it will just create another *.cap file and not continuing using the original one.

The exact command I ran is:

sudo airport sniff 12

Anyone can help please? Thanks in advance.

  • You can use cat to glue the files together, i.e. cat file1.cap file2.cap file3.cap > all.cap – John Keates Jan 4 '18 at 0:30
  • @JohnKeates The .cap files are binary files, and cat will not work properly with these. They can be merged in Wireshark, however. – Scot Jan 4 '18 at 2:35
1

You can suspend a command in the bash shell using control-Z. To resume the command, run fg.

  • ok, that seems to be working but let's my computer suddenly restarts and I want to continue capturing on the same channel and into the same *.cap file. Is there a way in a scenario like this? Thanks – yssup Jan 3 '18 at 18:59
  • @user Can you edit your question with the exact airport command you’re running? – grg Jan 3 '18 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .