On Jun 27, 2011, at 6:28 PM, Guy Harris wrote:
>
> On Jun 27, 2011, at 4:30 AM, tuexen@xxxxxxxxxxxxx wrote:
>
>> http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=37802
>>
>> User: tuexen
>> Date: 2011/06/27 04:30 AM
>>
>> Log:
>> Improve the report of illegal capture filters. Also show the interface description.
>
> That fixed
>
> $ ./tshark -i en1 -f fribbbbbit
> Capturing on en1
> tshark: Invalid capture filter "fribbbbbit" for interface en1!
>
> but
>
> $ ./tshark -i en1 fribbbbbit
> Capturing on en1
> tshark: Invalid capture filter "(null)" for interface en1!
>
> is still broken.
Right. I need to fix this. I'm not sure what the semantic of the final capture filter
should be... Should it be a default which is used when no other capture filter is
specified? Or should it be the filter which is used for every interface?
Currently I'm using the default semantic, but it is not clear that this is the
way to go. What do you think?
Best regards
Michael
>
> (And, yes, that syntax *is* supposed to work:
>
> $ nroff -man doc/tshark.1 | more
>
> ...
>
> SYNOPSIS
> tshark [ −a <capture autostop condition> ] ...
> [ −b <capture ring buffer option>] ... [ −B <capture buffer size> ]
>
> ...
>
> [ −X <eXtension option>] [ −y <capture link type> ] [ −z <statistics> ]
> [ <capture filter> ]
>
> as it works in tcpdump and snoop.)
> ___________________________________________________________________________
> Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
