 | 1 | initial version |
It seems to be a problem of quoting. Try:
sudo tshark -n -s0 -i bond0.62 -Y 'diameter.User-Name=="[email protected]"'
Also notice that I changed -R to -Y; otherwise this command fails as follows (at least with modern versions of tshark):
tshark: -R without -2 is deprecated. For single-pass filtering use -Y.
... and if you attempt to use -2R, you will get:
tshark: Live captures do not support two-pass analysis.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.