Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

As per the tshark -h output:

  --export-objects <protocol>,<destdir> save exported objects for a protocol to
                           a directory named "destdir"

There is no indication that a filter can be applied. I just tried it with Tshark 3.0.1 and all http objects are saved. Whether I have a display filter for a specific tcp stream active or not doesn't matter, all http objects in the file are saved.

It would be useful if some filtering can be done, so you may add a feature request to Bugzilla for it.