Wireshark-users: Re: [Wireshark-users] Display like filter without using Wireshark GUI.
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 5 Dec 2009 13:52:09 -0800

On Dec 5, 2009, at 11:40 AM, sean bzd wrote:


Probably a dump question
Yes, it's definitely a question about dumps of network traffic, so it's a dump question. It's not a dumb question, however. :-)
but is there a concept of display filter without using wireshark GUI? Meaning that I'm capturing traffic using dumpcap using some capture filter. Is there a way to filter further (like a display filter) 

How about a display filter?

	frame contains 04:02:ff:01:32


without loading the .pcap file in the wireshark?
How about using TShark with that filter expression as a "read filter", to check whether a given capture file has a packet containing that sequence of bytes?