I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets.
I'm aware that I can use something called a ring buffer to limit the filesize of Wireshark files and just keep Wireshark running. However, I would like to only start capturing traffic once a specific network traffic threshold is reached as this would make it easier for me to separate the files before inspecting them.
I have looked at several command line tools such as iftop, vnstat and nload, which all do a nice job of providing output to the terminal.
However, can someone help me with a command in either one of those tools or another nice way to simply capture the DTR that would allow me to start wireshark capture? Else, is there an existing command in Tshark that allows this to happen?