Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

It seems to be a problem of quoting. Try:

sudo tshark -n -s0 -i bond0.62 -Y 'diameter.User-Name=="[email protected]"'

Also notice that I changed -R to -Y; otherwise this command fails as follows (at least with modern versions of tshark):

tshark: -R without -2 is deprecated. For single-pass filtering use -Y.

... and if you attempt to use -2R, you will get:

tshark: Live captures do not support two-pass analysis.