Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Can you put a script wrapper around Wireshark and specify the port at startup?

-d <layer type>==<selector>,<decode-as protocol>
Like Wireshark's Decode As... feature, this lets you specify how a layer type should be dissected. If the layer type in question (for example, tcp.port or udp.port for a TCP or UDP port number) has the specified selector value, packets should be dissected as the specified protocol.

Example: -d tcp.port==8888,http will decode any traffic running over TCP port 8888 as HTTP.

See the tshark(1) manual page for more examples.