Wireshark · Wireshark-users: Re: [Wireshark-users] Value too large for defined data type

[Andrej van der Zee <andrejvanderzee@xxxxxxxxx>]

Hi,

cat big.cap | dumpcap -i- -w smaller.cap -b filesize:65536

I was wondering why the capture filter is not working as I expect. I want to dump only the packets that have a specific ip for src. I do it like this:

cat big.cap | dumpcap -i- -w smaller.cap -b filesize:65536 -f "src host 1.2.3.4"

But somehow all the packets are dumped anyway. Am I misunderstanding something?

Somehow the capture filter _expression_ is completely ignored when dumpcap reads from a pipe: When I use a bogus _expression_ it does not complain at all.

Is there any way to use capture filters when dumpcap reads from a pipe? I know I can do it in multiple steps with tshark, but this is much less convenient.

 Thank you,
Andrej