Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2234] Filtering tshark captures with display filters (-R)

Date: Thu, 23 Aug 2012 04:56:10 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234

Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |darkjames-ws@xxxxxxxxxxxx

--- Comment #22 from Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> 2012-08-23 04:56:09 PDT ---
>From r43102 it's possible to use pipe as workaround.

Instead of:
$ tshark -i XXX -R 'yourfilter' -w file.pcap
do:
$ dumpcap -i XXX -w - | tshark -r - -R 'yourfilter' -w file.pcap

It's worthy to mention that wiretap don't have any special handling of pipes,
and it'll read data in whole I/O block size for pipe (typically 4096B). 
Captured data will be saved with delay, and you might also lose last 4K of
data.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.