Wireshark-users: [Wireshark-users] Shell script to use tshark
From: "Rafael Morita" <rafael.morita@xxxxxxxxxxxxxxxxxxxxxx>
Date: Thu, 10 Jul 2008 17:36:19 -0300
Hello,

I am making a script for set up a filter, and then it uses tshark to filter the capture.

Here is an example of the input and what it have to do:

./tshark.sh SIP.cap674.gz output.cap [email protected] 1751131597 [email protected] [email protected]



and the output was to be:

/usr/bin/tshark -r SIP.cap674.gz -w output.cap -R 'rtp or sip.Call-ID contains "[email protected]" or sip.Call-ID contains "1751131597" or sip.Call-ID contains "[email protected]" or sip.Call-ID contains "[email protected]"'



if I just print that output, copy and paste to execute in terminal, it works. but if I make it to run in the script, the tshark prints this error:

tshark: Read filters were specified both with "-R" and with additional command-line arguments

Do you know if there is any limitations to use tshark in a script (Bash)?

Here is the code of the script:

[code]

#!/bin/bash

let i=$#
if [ $i -lt 3 ]
        then
        echo wrong parameters!
        exit 0
fi

input="$1"
shift
output="$1"
shift

filter="'rtp"

let i--

while test "$1"
do

         i=$((i+1))
        filter=$filter" or sip.Call-ID contains \"$1\""
        shift
done

filter=$filter'

args="-r $input -w $output -R $filter"
Tshark="/usr/bin/tshark"

execute="$Tshark $args"

echo "$execute"
echo

$execute

echo Filtered capture in $output

[/code]