Wireshark-users: Re: [Wireshark-users] question about exporting/filtering files

From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Wed, 02 Dec 2009 11:35:31 -0800

Richard Bejtlich wrote:

> Any rationale for why the display filter can be used to limit -w to
> only the packet of interest when used with -r , but not when doing
> live capture?

It's a by-product of privilege separation, and is a bug:

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234