ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Filter existing file

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Tue, 22 Jan 2008 11:11:05 -0500


Kuhs Lukas wrote:
Hi,

I want to filter an existing pcap-file using dumpcap on Windows. This is
not possible since there is no infile option anymore. Tethereal had this
option. My question is, whether this will be included in a later version
or not. Do you know any workaround except for using tethereal? I need to
execute it on the command line.

dumpcap is only a capturing tool. If you want to filter or do analysis, better use tshark (it's the equivalent of tethereal after the name change).