Wireshark-dev: [Wireshark-dev] Capture Filter Equivalent of tshark -d optino!
From: "Jack Liou" <[email protected]>
Date: Tue, 27 Nov 2007 17:50:00 -0800
I am currently using tshark's  "-d udp.port==21000,rtp" option to tell tshark to treat UDP diagram on port 21000 as RTP packets. Can the same thing be done in capture filter. I know its doable on a captured file by using the "Decode As" feature. But can it being done in capture or display filters? Thanks for the help!