In a previous question, I received some excellent explanation for a display filter. Now, I would like to use that filter with tshark. When I use the current one with tshark, I get a message that says it's a valid display filter but not a valid capture filter. What are the differences?
The display filter suggested was
asked 08 May '12, 21:54
edited 09 May '12, 00:31
As answer in the other question.
The syntax of display filters is totally different from the syntax of capture filters.
You can use this capture filter.
portrange works at least with 1.6.2. (just tested). If it does not work with an earlier versions (not checked), please upgrade.
answered 08 May '12, 22:26
Kurt Knochner ♦
edited 09 May '12, 00:32