Ask Your Question

How do I use a filter expression, such as "frame contains ..." or "tcp contains ..." in tshark?

asked 2020-12-06 15:44:03 +0000

moraist gravatar image

updated 2020-12-06 20:39:22 +0000

Guy Harris gravatar image

Hi Guys,

I am trying to use the same options "frame contains XXXX" and "tcp contains XXXX" in the tshark, but I can't do that. These options are available in the tshark? How I can do that?

edit retag flag offensive close merge delete


What options did you try? Did you consult the manual page?

Jaap gravatar imageJaap ( 2020-12-06 16:35:40 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-12-06 16:53:27 +0000

Chuckc gravatar image
$ tshark -r ./ultpcap2.pcapng -Y "frame contains \"http\""  | wc
    105    1589   16286

$ tshark -r ./ultpcap2.pcapng -Y "tcp contains \"http\""  | wc
     59     802    7940

The search string needs double quotes that are "escaped" since the string passed to -Y also needs quotes.
Brief discussion here in a question about tshark.

edit flag offensive delete link more


The escaping, and\or quoting depends on the shell, e.g. for PowerShell (on Windows at least) you can mix single and double quotes, e.g. ... -Y "frame contains 'http'". The PowerShell escape is the backtick, so it could also be written ... -Y "frame contains `"http`".

grahamb gravatar imagegrahamb ( 2020-12-06 19:42:58 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-12-06 15:44:03 +0000

Seen: 7,904 times

Last updated: Dec 06 '20