Wireshark · Wireshark-dev: Re: [Wireshark-dev] Capture Filter Equivalent of tshark -d optino!

["Gilbert Ramirez" <gram@xxxxxxxxxxxxxxx>]

A capture filter will just limit which packets are saved to a file.
You can do that with this capture filter:

udp port 21000

The capture filter, however, will not set up your "decode as" option;
you need to do that outside the capture filter.

--gilbert

On 11/28/07, Jack Liou <jwliou95@xxxxxxxxx> wrote:
> Hi,
>
> I am currently using tshark's  "-d udp.port==21000,rtp" option to tell
> tshark to treat UDP diagram on port 21000 as RTP packets. Can the same thing
> be done in capture filter. I know its doable on a captured file by using the
> "Decode As" feature. But can it being done in capture or display filters?
> Thanks for the help!
>
> Jack
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
>