Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Capture filter

From: Chris Maynard <Chris.Maynard@xxxxxxxxx>
Date: Fri, 16 Sep 2011 20:05:00 +0000 (UTC)
Tharaneedharan Vilwanathan <vdharani@...> writes:

> $ tshark -i pipe_to_tshark -w test.pcap -f 'udp port 1900'
> $ tshark -i pipe_to_tshark -S -f 'udp port 1900'
> $ tshark -i pipe_to_tshark -w test.pcap -S -f 'udp port 1900'
> 
> In all the above cases, packets dont seem to be filtered. From the
> documentation, it looks like capture filter is valid only for live
> traffic.

See bug 1814: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814