Wireshark-users: Re: [Wireshark-users] TSHARK.EXE command line requirements with Filter are impos
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Thu, 27 Dec 2007 23:26:35 +0100
On Wed, Dec 26, 2007 at 01:47:59PM -0500, David DuPre wrote:
> 
> Given the following filter requirements:
> 
> frame.time ge "Dec 3, 2007 11:55:21.151151" && frame.time le "Dec 3, 2007 11:58:48.690761"
> 
> The filter above works fine if you paste it into the Wireshark GUI.
[...]
> It would be nice if the "Single Quote" was accepted by the filter 
> command sent inside a set of Double Quotes.

It works the other way around, you can use single quotes *around* a
filter expression that uses double quotes:

./tshark -r ~/traces/ssl-netcc.cap 'frame.time ge "Dec 21, 2007 20:39:47.750789000" && frame.time le "Dec 21, 2007 20:39:48.750789000"'

Hope this helps,
Cheers,
    Sake