tshark: ":" was unexpected in this context

When I use TShark (Wireshark) 4.0.4 (v4.0.4-0-gea14d468d9ca) to filter 'frame.protocols == raw:ip:udp:data' with following cli,

"tshark -r 1.pcap  -t ad -Y "frame.protocols == raw:ip:udp:data" -w 2.pcap"

the error msg appear.

tshark: ":" was unexpected in this context.
    frame.protocols == raw:ip:udp:data
                          ^

Please note that, I can use frame.protocols == "raw:ip:udp:data" to get filter result in Wireshark UI. How can I filter result result with tshark?

Comments

Yeap, that's the solution. Thanks.

isaac00112233 ( 2023-04-10 09:39:01 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

1 Answer