Hi , I am trying to filter sip traffic using tshark with capture filter option and specific sip from header field value.

edit

Thanks a lot for the kind help !!. The command got accepted with above correction in quotes.

But unfortunately I got another error while executing the command :

"tshark: Invalid capture filter": "sip.From == "sipp. <sip:[email protected]:5060>;tag=21633SIPpTag0015893""!. 
That string looks like a valid display filter; however, it isn't a valid capture filter (syntax error).

The same command worked if I use "-R" option (display filter).

tshark -i en01 -R 'sip.From == "sipp <sip:[email protected]:5060>;tag=21633SIPpTag0015893"'

At present I am not sure if tshark supports capture filter with this condition I saw it accepts filtering packets based on "src port" ie -f "src port 5060" Is it possible could you please suggest if this option for filtering traffic is supported with capture filter option in tshark as I need to do a capture filter with above condition.

-R is technically a read filter, not a display filter, but yes, it uses the same syntax as display filters. You can read more about Wireshark display filters on the wireshark-filter man page. Capture filters are very different though. Read more about them on the pcap-filter man page.

Capture filter based on data in packet
https://osqa-ask.wireshark.org/questi...

Have you looked at ngrep ?
https://en.wikipedia.org/wiki/Ngrep