Wireshark-users: Re: [Wireshark-users] Reading tcpdump files while still sniffing

From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 11 Jul 2006 22:09:42 +0200

On Tue, Jul 11, 2006 at 10:16:59AM +0800, Jeff Morriss wrote:
> 
> > Background: I want to set up 2-3 instances of Wireshark which read the
> > dumpfile but display only parts of the traffic by employing filters.
> > 
> > Are there other solutions?
> 
> Hmmm, not that I can think of (other than doing all your filtering after 
> the capture is done which is obviously not what you want).

If your system can handle it, you can start 2-3 instances of wireshark, all
capturing on the same interface, but each with a different capture- and/or
display filter applied.

If one system can't handle it, you might want to add a hub to repeat the
ethernet frames to multiple hosts, each having their own filters ;)


Cheers,   Sake