tshark: “-w” was unexpected in this context.

Question

Hello, I wrote a filter like that:

-r "c:\\temp\\test1.pcap" tcp.stream eq 17 -w "c:\\temp\\output\\tcp-stream17.pcap"

However, it says that "-w" was unexpected in this context. Any idea what is wrong? Thank you all.

Answer 1

Simply quoting the filter string doesn't work, you're mixing positional parameter use and explicit named parameter use. Either move the (positional) filter to the end:

-r C:\Temp\test1.pcap -w C:\temp\output\tcp-stream17.pcap tcp.stream eq 17

or add the -Y parameter to indicate it's a display filter (and quote the filter):

-r C:\Temp\test1.pcap -Y "tcp.stream eq 17" -w C:\temp\output\tcp-stream17.pcap

Also note that you don't need to escape the backslashes and as the paths don't have spaces you don't need to quote them either.

Answer 2

Use quotes around your filter expression.