Wireshark-dev: Re: [Wireshark-dev] Capture Filter Equivalent of tshark -d optino!
From: "Gilbert Ramirez" <[email protected]>
Date: Wed, 28 Nov 2007 11:28:09 +0530
A capture filter will just limit which packets are saved to a file.
You can do that with this capture filter:

udp port 21000

The capture filter, however, will not set up your "decode as" option;
you need to do that outside the capture filter.


On 11/28/07, Jack Liou <[email protected]> wrote:
> Hi,
> I am currently using tshark's  "-d udp.port==21000,rtp" option to tell
> tshark to treat UDP diagram on port 21000 as RTP packets. Can the same thing
> be done in capture filter. I know its doable on a captured file by using the
> "Decode As" feature. But can it being done in capture or display filters?
> Thanks for the help!
> Jack
> _______________________________________________
> Wireshark-dev mailing list
> [email protected]
> http://www.wireshark.org/mailman/listinfo/wireshark-dev