Or you could use:
$ tshark -r test.pcap -R 'http.content_type == "application/octet-stream"'
-w http.content_type.pcap
HTH
Joan
On Mon, 14 Sep 2009 07:44:57 +0200 Sake Blok wrote:
>
>On Sun, Sep 13, 2009 at 10:08:18PM -0400, Kvetch wrote:
>> Hello, how can I properly escape a character in a tshark contains
>> string? My filter has a forward slash in it which appears to be
>> throwing tshark off . The filter is -- http contains
>> "application/octet-stream" but the / is breaking the command. Kicking
>> back an error stating
>> tshark: "/" was unexpected in this context.
>
>You could use:
>
>tshark -r http.cap -R 'http contains "application/octet-stream"'
>
>Cheers,
>
>
>Sake
>___________________________________________________________________________
>Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>Archives: http://www.wireshark.org/lists/wireshark-users
>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
