Wireshark-users: Re: [Wireshark-users] tshark escape character
Or you could use:
$ tshark -r test.pcap -R 'http.content_type == "application/octet-stream"'
-w http.content_type.pcap

HTH
Joan

On Mon, 14 Sep 2009 07:44:57 +0200 Sake Blok wrote:
>
>On Sun, Sep 13, 2009 at 10:08:18PM -0400, Kvetch wrote:
>> Hello, how can I properly escape a character in a tshark contains
>> string?  My filter has a forward slash in it which appears to be
>> throwing tshark off .  The filter is -- http contains
>> "application/octet-stream" but the / is breaking the command.  Kicking
>> back an error stating
>> tshark: "/" was unexpected in this context.
>
>You could use:
>
>tshark -r http.cap -R 'http contains "application/octet-stream"'  
>
>Cheers,
>
>
>Sake
>___________________________________________________________________________
>Sent via:    Wireshark-users mailing list <[email protected]>
>Archives:    http://www.wireshark.org/lists/wireshark-users
>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:[email protected]?subject=unsubscribe