C:\Program Files\Wireshark>tshark.exe -i 4 -x -t ad -R
"myprotodissector.something==528" -b filesize:5000 -w
C:\Traffic.pcap
This is what the manual says:
-R <read
(display) filter>
Cause the specified filter (which uses the syntax of read/display filters,
rather than that of capture filters) to be applied before printing a decoded
form of packets or writing packets to a file; packets not matching the filter
are discarded rather than being printed or written.
A
capture or read filter can either be specified with
the -f or -R option,
respectively, in which case the entire filter _expression_ must be specified as
a single argument (which means that if it contains spaces, it must be quoted),
or can be specified with command-line arguments after the option arguments, in
which case all the arguments after the filter arguments are treated as a
filter _expression_. Capture filters are supported only when doing a live
capture;
read filters are supported when doing a live capture and when reading a
capture file, but
require TShark to do more work when filtering, so you might be more likely to
lose packets under heavy load if you're using a read filter. If the filter is
specified with command-line arguments after the option arguments, it's a
capture filter if a capture is being done (i.e., if
no -r option was specified) and a read filter if a
capture file is being read (i.e., if a -r option
was specified).
