Wireshark · Wireshark-dev: Re: [Wireshark-dev] Feature Request for EDITCAP - Selecting by IP Address and Port Number

[Bill Meier <wmeier@xxxxxxxxxxx>]

Bill Meier wrote:
> I guess not (altho the error message is a bit weird):
>
>      Only read filters, not capture filters, can be specified when
>      reading a capture file.

I'm too quick off the mark today.

-f is the switch to specify a capture filter so the error message is 
correct.

The follow  does seem to work, however:

tshark -r <filename> -R <read-filter> -w <output filename>