Wireshark-dev: [Wireshark-dev] New feature
From: "T. Hariharan" <[email protected]>
Date: Tue, 18 Aug 2009 23:14:57 -0700 (PDT)

I want to add the following wireshark feature. I would like to know others' opinion (is someone else already doing this, etc) before starting.

Add an option to stop the capture when the given filter is matched.
The option to dumpcap may look like:
-a filter:<filter-spec>
i.e. It's basically an addition to the auto-stop condition.
e.g: -a "filter: host and icmp"

This will be very useful when you know the exact packet that you want to trigger the auto-stop condition. You can start the capture and walk away without having to monitor the capture.