Ask Your Question

Revision history [back]

Using tshark to capture and Read filter at the same time

Is it possible to use tshark to capture and Read the filter at the same time

To Read, i use the below command line

tshark -i any -R "<any protocol="">" ex: tshark -i any -R "dns"

To Write into a capture file

tshark -i any -w "dns.pcap"

I am not able to combine them both into one as i get below error

tshark: -R without -2 is deprecated. For single-pass filtering use -Y. tshark: Read filters aren't supported when capturing and saving the captured packets.

Is there any better ways to try this to minimize my effort of Running two different command?