 | 1 | initial version |
Assuming that the filter has been correctly transcribed from the GUI, it's a quoting issue that the GUI filter box doesn't have to deal with. Try this:
tshark -i en01 -f 'sip.From == "sipp <sip:[email protected]:5060>;tag=21633SIPpTag0015893"'
Not that the filter now has outer single quotes for bash and inner double quotes for tshark.
| | 2 | No.2 Revision |
Assuming that the filter has been correctly transcribed from the GUI, it's a quoting issue that the GUI filter box doesn't have to deal with. Try this:
tshark -i en01 -f 'sip.From == "sipp <sip:[email protected]:5060>;tag=21633SIPpTag0015893"'
Not Note that the filter now has outer single quotes for bash and inner double quotes for tshark.