Revision history [back]

You need to use the -f <capture filter> option. For example:

/usr/bin/tshark -i napa2 -f "host 10.239.81.123"

For a more efficient capture filter, I'd recommend using the following instead:

/usr/bin/tshark -i napa2 -f "ip and host 10.239.81.123"

You can compare these two filters yourself using dumpcap's -d option.

Refs:

• tshark man page
• User Guide Section D.2. tshark: Terminal-based Wireshark
• pcap-filter man page
• dumpcap man page

You need to use the -f <capture filter> option. For example:

/usr/bin/tshark -i napa2 -f "host 10.239.81.123"

For a more efficient capture filter, I'd recommend using the following instead:

/usr/bin/tshark -i napa2 -f "ip and host 10.239.81.123"

You can compare these two filters yourself using dumpcap's -d option.

Refs:

• tshark man page
• User Guide Section D.2. tshark: Terminal-based Wireshark
• pcap-filter man page
• dumpcap man page
• User Guide Section D.4. dumpcap: Capturing with "dumpcap" for viewing with Wireshark