Wireshark · Wireshark-users: Re: [Wireshark-users] Need filters

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jun 23, 2010, at 3:59 PM, David H. Lipman wrote:

> "not udp port 137" and any other additions.
> If there are many, command line options are untenable.  Loading and parsing an ASCII file 
> would be the way to go.

One limit on the number of command-line filtering when capturing is that there are limits on the power of the filter expressions.  However, you might end up putting in a lot of filters to filter out particular hosts, for example.

If the command line is *itself* read from an ASCII file, then, obviously, command-line options do involve loading an ASCII file.  If somebody is typing that command at a command line, then:

	1) at least on UN*X command lines, you can say

		tshark -f `cat {filter}`

	   where {filter} is the name of a file containing the filter, although that is limited by the number of bytes of command-line argument that the UN*X in question supports;

	2) if you use tcpdump or WinDump rather than TShark or dumpcap to capture the traffic, it has a -F flag that takes, as an argument, the name of a file containing the filter expression (tcpdump/WinDump, TShark, and dumpcap all use libpcap/WinPcap to do traffic capture, so they all have the same capture filter syntax).