First time here? Check out the FAQ!

Ask Your Question
0

tshark - Save to file while filtering with display filter

asked Jun 28 '0

Ashwin N gravatar image

updated Jun 29 '0

Guy Harris gravatar image

Hi, When I run tshark with a capture filter, I can see the messages going to and from my machine. I am able to save to a pcap file using the -w and -F options.

But is there a way to do both simultaneously? (view the output using display filter and save to file whatever is captured during my session - preferable filtered)

When I try this, I receive the following error

tshark -Y bacnet -w bvlc.pcap -F pcap
tshark: Display filters aren't supported when capturing and saving the captured packets.

Is there any way I can do this?

Thanks, Ashwin N

Preview: (hide)

2 Answers

Sort by » oldest newest most voted
0

answered Jun 29 '0

Guy Harris gravatar image

updated Jun 29 '0

-Y bacnet is a display filter, not a capture filter.

A capture filter would be specified with -f, such as

tshark -f "tcp port 99" -w bvlc.pcap -F pcap

which does work.

We don't support using a display filter with a live capture; that's what the error message means.

Preview: (hide)
link
0

answered Jun 28 '0

Chuckc gravatar image

What operating system are you running on?
This works on Ubuntu.

Shell One:

$ tshark -i 1 -w ./bvlc.pcap -F pcap
Capturing on 'eth0'
194

In a second terminal/shell:

$ tail -c +1 -f ./bvlc.pcap | tshark -r - -Y arp
Preview: (hide)
link

Comments

Hi, I tried this out, and it does the trick. Great idea, thanks!!

Ashwin N gravatar imageAshwin N ( Jun 29 '0 )

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: Jun 28 '0

Seen: 5,026 times

Last updated: Jun 29 '20