Wireshark-bugs: [Wireshark-bugs] [Bug 2234] Filtering tshark captures with display filters (-R)
Date: Tue, 22 Sep 2009 08:26:38 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234





--- Comment #13 from Sake <[email protected]>  2009-09-22 08:26:34 PDT ---
(In reply to comment #12)
> (In reply to comment #11)
> > 
> > So what is the resolution?  How do I get the same functionality as the previous
> > tshark version?
> > 
> > Is this working in the newer release?
> 
> The bug is still open, so there is no resolution yet.
> 
> One workaround is, as mentioned, to do the display filtering in a post-capture
> run, though obviously that doesn't help you avoid writing all those unwanted
> packets to the disk in the first place.

Another workaround is to transform the display filter to a capture filter. The
command from your initial big-report could be transformed into:

tshark -f "(<have a long string of IP's>) and (udp port 5060 or udp port 53 or
tcp port 3868)" -F libpcap -w Trace -a duration:30


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.