On Nov 1, 2011, at 1:22 PM, Chip wrote:
> pcap-filters do or do not work with dumpcap?
If by "pcap-filters" you mean the filters implemented by libpcap and Winpcap, and described, in newer versions of libpcap, in the pcap-filter man page (and, in older versions, in the tcpdump man page for the tcpdump release contemporaneous with the libpcap release), the answer is that they work with dumpcap (because dumpcap uses libpcap/WinPcap to capture), and thus also work, when capturing, with Wireshark and TShark (because they run dumpcap to do their capturing).
