Ask Your Question

Read-Filter Option

asked 2024-02-21 18:26:47 +0000

intangir gravatar image

updated 2024-02-21 18:27:19 +0000

When I do something like:

wireshark.exe -k -i Ethernet -f udp -R dns
wireshark.exe -k -i Ethernet -f udp --read-filter dns

My assumption would be that it would start a new capture on Ethernet with a display filter of DNS. But I don't have any display filter selected in the display filter area when the capture loads up. Am I misunderstanding this option?

Windows 10 22H2, 4.2.3 x64
edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2024-02-21 18:35:04 +0000

Chuckc gravatar image

Could it be that you want a display filter instead of a read filter?

From the Wireshark man page:

-R|--read-filter <read (display)="" filter="">
When reading a capture file specified with the -r flag, ...
-Y|--display-filter <display filter="">
Start with the given display filter.
edit flag offensive delete link more


Oh yes, that's what I was looking for, thanks. Not sure what the read filter is for now though. Maybe it's meant to apply to file inputs. I'll have to play around with that sometime.

intangir gravatar imageintangir ( 2024-02-21 18:39:33 +0000 )edit

As per the man page, a "read filter" filters packets using display filter syntax, any that are excluded by the filter are discarded and not present in the output.

A display filter does not affect the packets in the capture, only those that are displayed.

grahamb gravatar imagegrahamb ( 2024-02-22 09:00:14 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2024-02-21 18:26:47 +0000

Seen: 82 times

Last updated: Feb 21