Read-Filter Option

asked 2024-02-21 18:26:47 +0000

intangir
3 ●2

updated 2024-02-21 18:27:19 +0000

When I do something like:

wireshark.exe -k -i Ethernet -f udp -R dns
wireshark.exe -k -i Ethernet -f udp --read-filter dns

My assumption would be that it would start a new capture on Ethernet with a display filter of DNS. But I don't have any display filter selected in the display filter area when the capture loads up. Am I misunderstanding this option?

Windows 10 22H2, 4.2.3 x64

answered 2024-02-21 18:35:04 +0000

Chuckc
3023 ●6 ●608 ●20

Could it be that you want a display filter instead of a read filter?

From the Wireshark man page:

-R|--read-filter <read (display)="" filter="">
When reading a capture file specified with the -r flag, ...

-Y|--display-filter <display filter="">
Start with the given display filter.

edit flag offensive delete link

Comments

Oh yes, that's what I was looking for, thanks. Not sure what the read filter is for now though. Maybe it's meant to apply to file inputs. I'll have to play around with that sometime.

intangir ( 2024-02-21 18:39:33 +0000 )edit

As per the man page, a "read filter" filters packets using display filter syntax, any that are excluded by the filter are discarded and not present in the output.

A display filter does not affect the packets in the capture, only those that are displayed.

grahamb ( 2024-02-22 09:00:14 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Read-Filter Option

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Read-Filter Option edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Read-Filter Option