Wireshark · Wireshark-users: Re: [Wireshark-users] Tshark -R option

[sean bzd <seanbzd@xxxxxxxxx>]

Sake,

Thank you so much. Thats the exact bug I'm running into. Reading through its description it looks like the problem is only when using -R with -w option. Knowing that, now I'm piping the output to a txt file instead of using -w and the -R option is working as expected. Solved my problem!!!!!

Thanks again!!

Sean.

On Wed, Sep 2, 2009 at 6:39 PM, Sake Blok <sake@xxxxxxxxxx> wrote:

See bug  2234 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234).

 

Cheers,

      Sake

 

----- Original Message -----

From: sean bzd

To: Community support list for Wireshark

Sent: Wednesday, September 02, 2009 9:24 PM

Subject: [Wireshark-users] Tshark -R option

Folks,

I'm using the following tshark command to capture some packets; i was expecting that only the packets satisfying the read filter condition "myprotodissector.something==528" would be written to the output file C:\Traffic.pcap; but this is not happening. The .pcap file contains lots of other packets not matching the read filter. I was expecting to see ONLY the packets satisfying the read filter to be in the output file. What is interesting though is while the capture is in progress, the stdout showing the number of packets is correctly indicating the # of packets satisfying the read filter. (for example, if I captured 100 packets, and 2 satisfied the read filter, stdout shows 2 but output file contains all the 100 packets).

C:\Program Files\Wireshark>tshark.exe -i 4 -x -t ad -R "myprotodissector.something==528" -b filesize:5000 -w C:\Traffic.pcap

This is what the manual says:

-R <read (display) filter>

Cause the specified filter (which uses the syntax of read/display filters, rather than that of capture filters) to be applied before printing a decoded form of packets or writing packets to a file; packets not matching the filter are discarded rather than being printed or written.

A capture or read filter can either be specified with the -f or -R option, respectively, in which case the entire filter _expression_ must be specified as a single argument (which means that if it contains spaces, it must be quoted), or can be specified with command-line arguments after the option arguments, in which case all the arguments after the filter arguments are treated as a filter _expression_. Capture filters are supported only when doing a live capture; read filters are supported when doing a live capture and when reading a capture file, but require TShark to do more work when filtering, so you might be more likely to lose packets under heavy load if you're using a read filter. If the filter is specified with command-line arguments after the option arguments, it's a capture filter if a capture is being done (i.e., if no -r option was specified) and a read filter if a capture file is being read (i.e., if a -r option was specified).

---

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe