Wireshark-users: [Wireshark-users] tshark: Read filters were specified both with "-R" and with ad
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Neil Fraser <cbr250@xxxxxxxxx>
Date: Sun, 30 Jan 2011 13:58:14 +1100
Hi,

I'm having an issue trying to extract certain calls from a dump I have already made with fairly specific criteria.

It appears it doesn't like my quotation marks I am using in my filter from wireshark. Im a novice at using tshark so i'll explain what im trying to achieve

input file : hammer2901b
output file: 0291400000
filter: sip.to.addr == "sip:0291400000@192.168.1.1:5060" or sip.to.addr == "sip:1887500434779620@123.456.123.456"

command I'm attempting to use in a linux environment:
tshark -r hammer2901b -w 0291400000 -R sip.to.addr == "sip:0291400000@192.168.1.1:5060" or sip.to.addr == "sip:1887500434779620@123.456.123.456"

output always remains as: tshark: Read filters were specified both with "-R" and with additional command-line arguments

Any advice greatly appreciated.

Regards,
Neil Fraser.