Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Using tshark to capture and Read filter at the same time

Is it possible to use tshark to capture and Read the filter at the same time

To Read, i use the below command line

tshark -i any -R "<any protocol="">" ex: tshark -i any -R "dns"

To Write into a capture file

tshark -i any -w "dns.pcap"

I am not able to combine them both into one as i get below error

tshark: -R without -2 is deprecated. For single-pass filtering use -Y. tshark: Read filters aren't supported when capturing and saving the captured packets.

Is there any better ways to try this to minimize my effort of Running two different command?