 | 1 | initial version |
Tshark only reads preference files. It does not write or create one (only wireshark does that).
With the command tshark -G folders you can see where tshark looks for the preference files. In your case the preference file is located at $HOME/.config/wireshark/preferences. If that file does not exists (fresh install) then tshark just uses default values.
There are a few options:
Option 1:
If the preference file does not exists you can create one. The preference file needs only to contain the variables you want to change. There is no need to add commented-out ones.
Option 2:
Specify a preference file on the command line: tshark -C my-pref-file
Option 3:
Override values on the command line: tshark -o "transum.tcp_port_ranges:25,80,443,1433,3389,102"
See also: https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html https://www.wireshark.org/docs/man-pages/tshark.html
