Wireshark-bugs: [Wireshark-bugs] [Bug 2234] Filtering tshark captures with display filters (-R)
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 23 Aug 2012 04:56:10 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234

Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |darkjames-ws@xxxxxxxxxxxx

--- Comment #22 from Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> 2012-08-23 04:56:09 PDT ---
>From r43102 it's possible to use pipe as workaround.

Instead of:
$ tshark -i XXX -R 'yourfilter' -w file.pcap
do:
$ dumpcap -i XXX -w - | tshark -r - -R 'yourfilter' -w file.pcap

It's worthy to mention that wiretap don't have any special handling of pipes,
and it'll read data in whole I/O block size for pipe (typically 4096B). 
Captured data will be saved with delay, and you might also lose last 4K of
data.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.