Wireshark · Wireshark-users: Re: [Wireshark-users] tshark escape character

[Sake Blok <sake@xxxxxxxxxx>]

On Sun, Sep 13, 2009 at 10:08:18PM -0400, Kvetch wrote:
> Hello, how can I properly escape a character in a tshark contains
> string?  My filter has a forward slash in it which appears to be
> throwing tshark off .  The filter is -- http contains
> "application/octet-stream" but the / is breaking the command.  Kicking
> back an error stating
> tshark: "/" was unexpected in this context.

You could use:

tshark -r http.cap -R 'http contains "application/octet-stream"'  

Cheers,


Sake