Good morning,

I am using the following syntax in an attempt to do the following:

Syntax:

/usr/local/bin/tshark -w /home/active_cap/ -d tcp.port==5060,sip -d tcp.port==68

01,http -d tcp.port==6802,http -d tcp.port==6800,http -b duration:900 -b filesize

:50000 -i vr0

Goals:

1)       Write only packets destined to/from port 5060, 6800, 6801 and 6802 (Preferably without decoding the packet)

2)       The file should roll-over after 900 seconds or 50mbytes

Currently, the above syntax is capturing _everything_, not just the specified ports.  Is the syntax incorrect, or is tshark not capable of doing what I want?

Thanks,

Les