Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: [Wireshark-users] Tshark and using display filters

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: "Irakli Natshvlishvili" <iraklin@xxxxxxxxx>
Date: Fri, 4 May 2007 12:14:14 -0800

I have a capture file, want to use tshark to filter packets and write a new file.

When I use

tshark -r all.cap -w filtered.cap -R udp contains "100"

'I'm getting

tshark Read filters were specified both with "-R" and with additional command-line arguments

Platform is XP with SP2. What I'm doing wrong?

--
I.N.
  • Follow-Ups:
    • Re: [Wireshark-users] Tshark and using display filters
      • From: Guy Harris
  • Prev by Date: Re: [Wireshark-users] wpa decryption and ":" in passphrase
  • Next by Date: Re: [Wireshark-users] Tshark and using display filters
  • Previous by thread: [Wireshark-users] WISH : WPA Decrypt
  • Next by thread: Re: [Wireshark-users] Tshark and using display filters
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation