Wireshark · Wireshark-users: [Wireshark-users] dumpcap and bpf assembler

[Richard Stearn <richard@xxxxxxxxxxxxxxxxxxxxxx>]

Is there a way of handing dumpcap a BPF assembler file rather than a
libpcap expression?

I have RTFM'd, googled and not found an answer.

Of course my reading ability and googlefu could be well broken :-)

Why, because I wish to filter on the protocol the network interface
currently believes the packet to be (skb->protocol), rather than what
the interface says it is and I have not found a libpcap expression that
achieves that.

--
Regards
	Richard