Wireshark-dev: Re: [Wireshark-dev] Feature Request for EDITCAP - Selecting by IP Address and Po
From: Bill Meier <[email protected]>
Date: Wed, 30 Jan 2008 11:53:34 -0500
Bill Meier wrote:
I guess not (altho the error message is a bit weird):

     Only read filters, not capture filters, can be specified when
     reading a capture file.
I'm too quick off the mark today.

-f is the switch to specify a capture filter so the error message is correct.
The follow  does seem to work, however:

tshark -r <filename> -R <read-filter> -w <output filename>