Command line capture filter syntax

Question

I want to start wireshark from the command line using a capture filter so that when wireshark starts it begins capturing immediately and is only capturing packets that I am interested in. I thought the -f would be the ticket but I am not sure what is going on here? It seems to be thinking that -f is a capture file? Thanks

C:\Program Files\Wireshark>wireshark -i 2 -k -f tcp port==443 C:\Program Files\Wireshark>

wireshark: You can't specify both a live capture and a capture file to be read.

Answer 1

You have a quoting issue and a syntax issue. As the capture filter includes spaces you must quote it, and to filter on tcp port 443, the capture filter would be tcp port 443. Your command line then becomes:

wireshark -i 2 -k -f "tcp port 443"

If you are just capturing for later analysis then you may want to look into dumpcap.