Ask Your Question

Why do I get an error with this tshark command line on Windows?

asked 2019-02-26 19:20:07 +0000

tomycat gravatar image

updated 2019-02-26 22:27:23 +0000

Guy Harris gravatar image

hello, my OS is Windows 7. I logged in with my WLAN data:

tshark -i 2 -w C:\chat\capture.pcap tcp port 12345
Capturing on 'Drahtlosnetzwerkverbindung 3'

Now I want a conversation, the port data 18677 should be selected:

tshark -r C:\chat\capture.pcap -T fields -e data 'tcp.srcport==18677' > C:\chat\outbound2.txt
tshark: "'tcp.srcport==18677'" is neither a field nor a protocol name.

what am I doing wrong?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-02-26 19:28:29 +0000

grahamb gravatar image

For a CMD shell use double quotes not single quotes around the display filter, e.g.

tshark -r C:\chat\capture.pcap -T fields -e data "tcp.srcport==18677" > C:\chat\outbound2.txt
edit flag offensive delete link more


thx, the capture.pcap file ist 100% ok. I see Port 12345 and 18677. I like killing 18677.

tshark -r C:\chat\capture.pcap -T fields -e data "tcp.srcport==18677" > C:\chat\outbound2.txt I do not get an error message. outbound2.txt the file is empty

My target is:`$ cat outbound2.txt






tomycat gravatar imagetomycat ( 2019-02-27 18:58:34 +0000 )edit

It would seem that your capture doesn't have any packets that have a source port of 18677. Try using "tcp.port==18677" as a filter to see traffic to or from that port.

grahamb gravatar imagegrahamb ( 2019-03-08 19:10:20 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-02-26 19:20:07 +0000

Seen: 57 times

Last updated: Feb 27