how to capture udp traffic with a length of 94

asked 2018-05-14 08:56:13 +0000

logn
1 ●2 ●2 ●3

updated 2018-05-14 10:16:54 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●951 ●227 https://www.wireshark.org

On Windows,when i try this code using PowerShell to creat a pcap file then get unique ip address:

C:\Users\long> wireshark\tshark -i ethernet -a duration:60 -f "udp" -Y "frame.cap_len>=90 && frame.cap_len<=100" -w test3.pcap

Its doesn't work.I dont know why,Can u help me.Thank in advance

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2018-05-14 09:08:42 +0000

grahamb

23790 ●4 ●951 ●227 https://www.wireshark.org

It doesn't work as per the error message reported:

tshark: Display filters aren't supported when capturing and saving the captured packets

You can convert the display filter part (-Y ...) to a capture filter:

wireshark\tshark -i ethernet -a duration:60 -f "udp and len>=90 and len <=100" -w test3.pcap

edit flag offensive delete link

Comments

Note that if an answer has solved your issue, you should accept it for the benefit of others with the same query by clicking the checkmark next to it.

grahamb ( 2018-05-14 09:17:45 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-05-14 08:56:13 +0000

Seen: 819 times

Last updated: May 14 '18

how to capture udp traffic with a length of 94 edit