 | 1 | initial version |
Filters after an interface argument only affect the most preceding interface. From the dumpcap man page:
-f <capture filter=""> Set the capture filter expression.
The entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted).
This option can occur multiple times. If used before the first occurrence of the -i option, it sets the default capture filter expression. If used after an -i option, it sets the capture filter expression for the interface specified by the last -i option occurring before this option. If the capture filter expression is not set specifically, the default capture filter expression is used if provided.
| | 2 | No.2 Revision |
Filters after an interface argument only affect the most preceding interface. From the dumpcap man page:
-f <capture filter=""> Set the capture filter expression.
The entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted).
This option can occur multiple times. If used before the first occurrence of the -i option, it sets the default capture filter expression. If used after an -i option, it sets the capture filter expression for the interface specified by the last -i option occurring before this option. If the capture filter expression is not set specifically, the default capture filter expression is used if provided.
Try the command line:
dumpcap -f "host 172.20.1.2" -i 3 -i 9 -b filesize:50000 -b files:20 -w "D:\captures\172-20-1-2.pcapng"