Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

There is no option to read the display filter from a file instead.

The Windows command line length is limited to 32,767 (wide) characters. (Limited by the CreateProcess system call.)

Option 1: Make sure to total length does not exceed 32k:

  • for in operator use ranges where possible. Not in { 1, 2, 3, 4 } but in {1..4}, etc.
  • remove all unnecessary spaces (in{1..4}).

Option 2: Use an OS that allows a larger command line length.
On Mac OS it is about 256 kbyte.
On Linux it is about 2 Mbyte.
To get the exact value use the command: echo $(( $(getconf ARG_MAX) - $(env | wc -c) - $(env | wc -l) * 8 - 8 )) (= ARG_MAX – environment array size).
More info: man execve

Option 3: Is there a better way to filter out what you want, resulting in a smaller filter? E.g tcp.stream in { ... }

And splitting up in batches is also a possibility. That will be a slow process.

There is no option to read the display filter from a file instead.

The Windows command line length is limited to 32,767 (wide) characters. (Limited by the CreateProcess system call.)

Option 1: Make sure to the total length does not exceed 32k:

  • for in operator use ranges where possible. Not in { 1, 2, 3, 4 } but in {1..4}in{1..4}, etc.
  • remove all unnecessary spaces (in{1..4}).

Option 2: Use an OS that allows a larger command line length.
On Mac OS it is about 256 kbyte.
On Linux it is about 2 Mbyte.
To get the exact value use the command: echo $(( $(getconf ARG_MAX) - $(env | wc -c) - $(env | wc -l) * 8 - 8 )) (= ARG_MAX – environment array size).
More info: man execve

Option 3: Is there a better way to filter out what you want, resulting in a smaller filter? E.g tcp.stream in { ... }

And splitting up in batches is also a possibility. That will be a slow process.