Revision history [back]

The client side (dumpcap and tshark) have to be compiled with support HAVE_PCAP_REMOTE.
dumpcap.c:

#ifdef HAVE_PCAP_REMOTE
    fprintf(output, "RPCAP options:\n");

On Windows, it is compiled in:

C:\Program Files\Wireshark>dumpcap -? 2>&1 | findstr /I rpcap
                               rpcap://<host>/<interface>
RPCAP options:
  -r                       don't ignore own RPCAP traffic in capture
  -u                       use UDP for RPCAP data transfer
  -A <user>:<password>     use RPCAP password authentication

And not on linux:

$ ./dumpcap -v | head -1
Dumpcap (Wireshark) 3.7.0 (v3.7.0rc0-69-g79ed34e1c697)
$ 
$ ./dumpcap -h | grep rpcap
                               rpcap://<host>/<interface>

The man page and usage for dumpcap and tshark could use more info w.r.t. using rpcap.
And perhaps a check in the code that displays a better error when rpcap: is specified but the code is not compiled for it.

The client side (dumpcap and tshark) have to be compiled with support HAVE_PCAP_REMOTE.
dumpcap.c:

#ifdef HAVE_PCAP_REMOTE
    fprintf(output, "RPCAP options:\n");

On Windows, it is compiled in:

C:\Program Files\Wireshark>dumpcap -? 2>&1 | findstr /I rpcap
                               rpcap://<host>/<interface>
RPCAP options:
  -r                       don't ignore own RPCAP traffic in capture
  -u                       use UDP for RPCAP data transfer
  -A <user>:<password>     use RPCAP password authentication

And not on linux:

$ ./dumpcap -v | head -1
Dumpcap (Wireshark) 3.7.0 (v3.7.0rc0-69-g79ed34e1c697)
$ 
$ ./dumpcap -h | grep -i rpcap
                               rpcap://<host>/<interface>