Revision history [back]

Filters after an interface argument only affect the most preceding interface. From the dumpcap man page:

-f <capture filter=""> Set the capture filter expression.

The entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted).

This option can occur multiple times. If used before the first occurrence of the -i option, it sets the default capture filter expression. If used after an -i option, it sets the capture filter expression for the interface specified by the last -i option occurring before this option. If the capture filter expression is not set specifically, the default capture filter expression is used if provided.

Filters after an interface argument only affect the most preceding interface. From the dumpcap man page:

-f <capture filter=""> Set the capture filter expression.

The entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted).

This option can occur multiple times. If used before the first occurrence of the -i option, it sets the default capture filter expression. If used after an -i option, it sets the capture filter expression for the interface specified by the last -i option occurring before this option. If the capture filter expression is not set specifically, the default capture filter expression is used if provided.

dumpcap -f "host 172.20.1.2" -i 3 -i 9 -b filesize:50000 -b files:20 -w "D:\captures\172-20-1-2.pcapng"