Wireshark · Wireshark-users: Re: [Wireshark-users] Simultaneous use of capture and display filter while capturing with tshark

[Guy Harris <guy@xxxxxxxxxxxx>]

On May 28, 2009, at 7:02 AM, Kevin wrote:

> Why would you use the display filter?  Try -f "host 10.20.30.20 and  
> tcp"

Or, if he was using a display filter of "ip.src == 10.20.30.20", a  
capture filter of "src host 10.20.30.20 and tcp".