I only want to get UDP packets with source port 8000

hahaha
1 ●1 ●1 ●1

I used the tshark command "tshark -i eth1 udp dst port 8000", but no data packets were obtained. I want to ask if the command is correct.

1 Answer

Sort by » oldest newest most voted

Guy Harris
19890 ●3 ●633 ●207

I want to ask if the command is correct.

No, it's not.

You want packets with the source port being 8000, but "dst port 8000" matches packets with the destination port being 8000.

Try

tshark -i eth1 udp src port 8000

Please start posting anonymously - your entry will be published after you log in or create a new account.

1 follower

Asked: 2021-06-23 08:11:36 +0000

Seen: 133 times

Last updated: Jun 23 '21

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.