First time here? Check out the FAQ!

Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Assuming that the filter has been correctly transcribed from the GUI, it's a quoting issue that the GUI filter box doesn't have to deal with. Try this:

tshark -i en01 -f 'sip.From == "sipp <sip:sipp@10.xx.xx.xx:5060>;tag=21633SIPpTag0015893"'

Not that the filter now has outer single quotes for bash and inner double quotes for tshark.

click to hide/show revision 2
No.2 Revision

updated Dec 16 '19

Jaap gravatar image

Assuming that the filter has been correctly transcribed from the GUI, it's a quoting issue that the GUI filter box doesn't have to deal with. Try this:

tshark -i en01 -f 'sip.From == "sipp <sip:sipp@10.xx.xx.xx:5060>;tag=21633SIPpTag0015893"'

Not Note that the filter now has outer single quotes for bash and inner double quotes for tshark.