TShark inherits that behavior from Wireshark (which _does_ let you go back in time). It probably shouldn't do that, but you can work around the problem using the ring buffer (-b) option: http://www.wireshark.org/docs/man-pages/tshark.html
TShark inherits that behavior from Wireshark (which _does_ let you go back in time). It probably shouldn't do that, but you can work around the problem using the ring buffer (-b) option: http:// www.wireshark. org/docs/ man-pages/ tshark. html