On a UN*X system:
You can store a capture filter in a file and then use:
dumpcap -i 5 -f "$(cat capturefilterfile.txt)"
That works if you only have a single capture filter in that file, but if you want to keep multiple capture filters in the file, prepended with some label, then you can also do that as well. Let's assume you prepend each filter like this:
Filter1:udp
Filter2:tcp
Filter3:ip and (udp or tcp)
Then you'll just need to do something like this instead:
dumpcap -i 5 -f "$(grep ^Filter3 capturefilterfile.txt | cut -d ':' -f 2)"
If you don't want to type that each time, you can simplify things by wrapping it into a script, say dumpcap.sh
with contents like:
#!/bin/sh
if (( $# < 1 ))
then
echo "Usage: $0 <capturefilterlabel>"
exit 0
fi
interface=5
dumpcap -i $interface -f "$(grep ^$1 capturefilterfile.txt | cut -d ':' -f 2)"
Now if you want to use the Wireshark cfilters
file, then the syntax and parsing is a bit different. For that, you'd need to modify the above dumpcap.sh
script to something like this:
#!/bin/sh
if (( $# < 1 ))
then
echo "Usage: $0 <capturefilterlabel>"
exit 0
fi
interface=5
cfilterfile=/usr/share/wireshark/cfilters
cfilter=$(grep "^\"$1\"" $cfilterfile | cut -d '"' -f 3 | awk '{$1=$1;print}')
dumpcap -i $interface -f "$cfilter"
See also: https://gitlab.com/wireshark/wireshar...
The dumpcap man page says
predef
should work but doesn't seem to be implemented:8091: Allow/Create an option to use "capture filter" labels defined in wireshark GUI from CLI