This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Using “;” character in tshark display filter

0

I'm trying to write a display filter in tshark where the value I'm searaching for includes the ";" character. The problem is this character seems to have some special significance with tshark and it complains that it was unexpected. This is true even when the display filter is cleanly encapsulated in quotation marks. For example:

tshark -r file.pcap -R "diameter.Session-Id==a;b;c;d"

Also tried:

tshark -r file.pcap -R "diameter.Session-Id=="a;b;c;d""

So... is there some kind of character expected to be used to tell tshark that the ; character should be treated as part of the string in the display filter?

asked 20 May '13, 16:03

Quadratic's gravatar image

Quadratic
1.9k●6●9●28
accept rate: 13%

One Answer:

1

Please use the following syntax:

Linux:

tshark -r file.pcap -R 'diameter.Session-Id=="a;b;c;d"'

Windows (uses different quoting rules on the CLI):

tshark -r file.pcap -R "diameter.Session-Id==""a;b;c;d"""

Regards
Kurt

answered 20 May '13, 16:40

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 20 May '13, 16:40

And for completeness, when using PowerShell, use single quote marks to group the argument and then escaped double quotes to quote the parameter value:

tshark -r file.pcap -R 'diameter.Session-Id==\"a;b;c;d\"'
(21 May '13, 01:45) grahamb ♦

Ah, thanks. That works.

(21 May '13, 19:38) Quadratic