This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to apply display filter for a cap file and save it as seperate cap file with filtered data only by using Tshark..?

0

Is there way to apply display filter for a cap file and save it as seperate cap file with filtered data only..? eg, 1.I have a cap file with full packets 2.Apply display filter to the first cap and save the filtered packets in to another cap file..!

I need this to be done through tshark or some other CLI utility...

Thanks in advance..

asked 01 Aug '12, 04:42

ArunDev's gravatar image

ArunDev
21337
accept rate: 0%

edited 01 Aug '12, 04:45


One Answer:

2

You can do tshark -r file1.cap -R "displayfilter" -w file2.cap, which reads file1, applies the filter specified after "-R" and writes it back to file2.cap.

answered 01 Aug '12, 04:48

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Hi.. Thanks for your answer.... But when try to do this i am getting a message as below..!
"tshark: The capture file being read can't be written as a "pcapng" file." command used: tshark -r C:\Users....\Desktop\TDP\new.cap -R "http.referer" -w C:\Users....\Desktop\file2.cap

The first cap file is captured using nmcap(NTMON) and the OS i use is windows 7

Am i doing anything wrong?

Thanks

(01 Aug '12, 05:09) ArunDev

looks like tshark has some trouble writing your nmcap format as pcap-ng. You can try and see if it works when writing to pcap format, by adding the parameter "-F libpcap" to the other parameters.

(01 Aug '12, 05:52) Jasper ♦♦

I can open the netmon cap file in wirehark and save as pcap or pcapng... and found that the above command works fine.... i need everything needs to be done through cmd....is there any other way i can get the result....Thanks

(01 Aug '12, 06:16) ArunDev
1

You could also use editcap to convert the files first if tshark doesn't; maybe it works with that approach. editcap also has the -F parameter which can be used to write a different file format. You could write a script that converts the file first using editcap and then filters it by using tshark.

(01 Aug '12, 08:20) Jasper ♦♦

Thank you.... The Trick worked...! First i converted my nmcap to k12txt and back to pcap...Now tshark can do anything....

(01 Aug '12, 21:41) ArunDev