Wireshark · Wireshark-users: Re: [Wireshark-users] Value too large for defined data type

[Andrej van der Zee <andrejvanderzee@xxxxxxxxx>]

Hi,

cat big.cap | dumpcap -i- -w smaller.cap -b filesize:65536

I was wondering why the capture filter is not working as I expect. I want to dump only the packets that have a specific ip for src. I do it like this:

cat big.cap | dumpcap -i- -w smaller.cap -b filesize:65536 -f "src host 1.2.3.4"

But somehow all the packets are dumped anyway. Am I misunderstanding something?

Thank you,
Andrej