 | 1 | initial version |
More of a bash question than a tshark question, but my guess (did not test it) is that you need to use:
TSHARK_FILTER="port 18581 or port 5060 or (port 16050 and greater 72)"
tshark -q -n -i any -f "$TSHARK_FILTER" -b files:100 -b filesize:40000 -w /tmp/test.pcap
This will put the whole filter between quotes.