Using Wireshark Command Line Tools & Scripting HANDS-ON LABGUIDE Case 8 : Create a new trace file for a specific pop user that contains only his pop sessions. (use mail.cap) a)First get an idea of a typical POP session, use : tshark -r mail.cap -R