Thats what I was actually trying to do. I don't want to discard the packets but just filter the captured ones on the display. That's the reason I was playing around with display filter arguments.
On Mon, Apr 14, 2008 at 12:53 PM, Guy Harris <
guy@xxxxxxxxxxxx> wrote:
Jason wrote:
> However, the OP of this thread appeared to be talking about using '-R'
> to set the Display Filter in wireshark during an autostarted, '-k', live
> capture. So, we're not looking for setting a capture filter with '-R'
> like tshark does for reading files. Only to set the Diplay Filter when
> autostarting. Maybe it should have a different switch, to clarify it.
Given that the "R" in "-R" stands for "read", as in "read filter", as in
"filter that's applied when reading packets", that would be the wrong
flag for a *display* filter that's not applied when Wireshark initially
reads in the packets - i.e., a "set the display filter" flag wouldn't
cause packets that don't match the filter to be discarded when the
capture is being read, it would just cause them not to be displayed -
clearing the display filter would show those packets.
