Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

I Discovered how to do this filter!

Here is and example! tshark -r capture.pcap -Y "(vlan.id == 2010 and vlan.id != 2010) or (vlan.id == 2020 and vlan.id != 2020)"-o 'gui.column.format:"Mac-Source","%uhs","Vlan","%Cus:vlan.id"'