Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9161] TShark read filters for tcp.analysis.* don't work

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 1 on bug 9161 from Chris Maynard

(In reply to comment #0)
> Attempting to use any TShark tcp.analysis.{whatever} read filters doesn't
> write results out to a file.
> 
> Example:
> tshark -r 00000_20130912135745.cap -q tcp.analysis.window_full ||
> tcp.analysis.zero_window -w tcp.analysis.cap

Your syntax is wrong there, was that just a typo?

Did you try:

    tshark -r 00000_20130912135745.cap -2R "tcp.analysis.window_full ||
tcp.analysis.zero_window" -w tcp.analysis.cap

or:

    tshark -r 00000_20130912135745.cap -Y "tcp.analysis.window_full ||
tcp.analysis.zero_window" -w tcp.analysis.cap

---

      You are receiving this mail because:

• You are watching all bug changes.