On 30 jan 2011, at 03:58, Neil Fraser wrote:
> command I'm attempting to use in a linux environment:
> tshark -r hammer2901b -w 0291400000 -R sip.to.addr == "sip:[email protected]:5060" or sip.to.addr == "sip:[email protected]"
>
> output always remains as: tshark: Read filters were specified both with "-R" and with additional command-line arguments
That is because tshark will interpret this as "-R sip.to.addr" and use the rest of the commandline arguments as a read filter. So either you drop the -R or you have to make sure that the argument after -R is one string. You can do this by placing the whole filter within single quotes:
-R 'sip.to.addr == "sip:[email protected]:5060" or sip.to.addr == "sip:[email protected]" '
Cheers,
Sake
