Command file to easily dump UDP traffic - n4af/TR4W GitHub Wiki

This assumes you have installed the standard version of Wireshark on Windows. There is normally a file called DUMPCAP installed in the same directory. If you have files in different places, adjust this script accordingly. This will dump any UDP traffic on port 12060 sent to the loopback adapter. If the loopback adapter name on your system is not \Device\NPF_Loopback, you can run DUMPCAP with -d to show all the interfaces. The loopback is used when running DUMPCAP on the same system as TR4W.

@echo off
setlocal EnableExtensions

rem get unique file name 
:uniqLoop
set "uniqueFileName=%tmp%\bat~%RANDOM%.pcap"
if exist "%uniqueFileName%" goto :uniqLoop



"c:\program files\wireshark\DUMPCAP" -i \Device\NPF_Loopback -f "udp port 12060" -P -w %uniqueFileName%

echo %ERRORLEVEL%

start "c:\program files\wireshark\wireshark" %uniqueFileName%