Wireshark · Wireshark-users: Re: [Wireshark-users] tethereal Display filter problems.

[Guy Harris <guy@xxxxxxxxxxxx>]

Shane Milburn wrote:

> I've got around 100 captures that I need to process and extract some 
> http & XML data from into a text file. I'm having problems getting the 
> command-line syntax to work. Can someone take a look at my syntax and 
> let me know what I'm doing wrong?
>
>  $ tethereal -r soaplogs_00001_2007011808084032.cap -R "(http.host eq "myhost.mydomain.com") || (xml.tag == "<rejectlogin xsi:type=\"xsd:int\">") -T text -V > soap-xml-log.txt

What you're doing wrong is using using double-quotes around the filter 
expression.  The filter expression includes double-quotes, so the first 
double-quote within the expression is interpreted by the shell as an 
*ending* quote.

Try

	tethereal -r soaplogs_00001_2007011808084032.cap -R '(http.host eq 
"myhost.mydomain.com") || (xml.tag == "<rejectlogin 
xsi:type=\"xsd:int\">")' -T text -V > soap-xml-log.txt