Wireshark-users: Re: [Wireshark-users] Display like filter without using Wireshark GUI.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 5 Dec 2009 13:52:09 -0800

On Dec 5, 2009, at 11:40 AM, sean bzd wrote:

Probably a dump question

Yes, it's definitely a question about dumps of network traffic, so it's a dump question. It's not a dumb question, however. :-)

but is there a concept of display filter without using wireshark GUI? Meaning that I'm capturing traffic using dumpcap using some capture filter. Is there a way to filter further (like a display filter)

How about a display filter?

	frame contains 04:02:ff:01:32

without loading the .pcap file in the wireshark?

How about using TShark with that filter expression as a "read filter", to check whether a given capture file has a packet containing that sequence of bytes?