Wireshark-users: Re: [Wireshark-users] Filter using command line

From: "Nutkins, Thomas" <tom.nutkins@xxxxxxxxxxxxxxxxxxxxxx>
Date: Wed, 10 Mar 2010 20:12:17 +0100
This is the way I do it.....from a DOS prompt in Windows
“c:\Program Files\Wireshark\tshark.exe" -r 500MB_capture_file.cap -R "ip.addr==" -w output_file_name.cap
Substitute for your IP address.

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Boaz Galil
Sent: 10 March 2010 17:08
To: Community support list for Wireshark
Subject: [Wireshark-users] Filter using command line



Dear experts,

I have packet capture file that contains 500MB data.

I would like to filter specific traffic of specific IP address. Unfortunately when I open the wireshark GUI eventually the wireshark will crash (due to the fact that this is a big capture file).


I don’t want to split the file to smaller files, is it possible to do the filter using command line?

Thanks in advance,