tshark: That string looks like a valid display filter; however, it isn’t a valid

Question

here is the command I tried to use:

tshark -i eth1 -f diameter

And the output:

tshark: Invalid capture filter: "diameter"!
That string looks like a valid display filter; however, it isn't a valid capture filter (syntax error).
Note that display filters and capture filters don't have the same syntax, o you can't use most display filter expressions as capture filters.
See the User's Guide for a description of the capture filter syntax.

That is the user guide I found. But I didnt get any useful info according to my issue. Please help.
Edit: I would like to save only the diameter packets, but when I am using this command:

tshark -i eth1 -R diameter -w /home/ttcn3/traces/

I got this:

tshark: Read filters aren't supported when capturing and saving the captured packets.

So how can save only those packets which I would filter by protocol name?

Answer 1

1

The following might work for you: tshark -i eth1 -f "tcp port 3868"

answered 04 Feb '13, 10:16

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

thanks, in this case, but in generally I would do with protocol filtering, not with port filtering

(04 Feb '13, 10:23) HiB

You indicated that, "I would like to save only the diameter packets". That implies that you are in need of an appropriate capture filter in order to accomplish this. Since you need a capture filter, you must follow capture filter syntax, and not Wireshark's display filter syntax for the diameter protocol. See also the Wireshark diameter wiki page.

(04 Feb '13, 11:00) cmaynard ♦♦

Answer 2

The output you're seeing is a pretty good explanation of what's going wrong. Capture filters are used to limit the packets that are actually sniffed off the wire. You are probably looking for a Display Filter, which can be applied using the -R flag:

tshark -i eth1 -R diameter

I'm not familiar with the 'diameter' protocol, but I believe this will help you out.