When following command executed wireshark -i \DEVICE\NPF_{42C75388-2A3B-4C42-B581-F1E7604B7255} -k -f port 80 -c 10 wireshark:You can't specify both a live capture and a capture file to be read. Any reason for this message asked 11 Jun '13, 20:44  krishnayeddula edited 11 Jun '13, 20:54 |
One Answer:
You need to contain the capture filter in quotes: wireshark -i \DEVICE\NPF_{42C75388-2A3B-4C42-B581-F1E7604B7255} -k -f "port 80" -c 10 answered 11 Jun '13, 21:02  Quadratic |
Thanks it worked but wireshark -i \DEVICE\NPF_{42C75388-2A3B-4C42-B581-F1E7604B7255} -k -f tcp -c 10 is working with out any quotes.
That one works without quotes because there is no space in it. If you have spaces, you need quotes to contain it otherwise it thinks "port" is your capture filter and it doesn't know what 80 is.
Another note, if you run
tshark -Dyou will get a list of the configured adaptors ordered by "index" and that index number can be used in place of the \Device\NPF_{GUID} string, e.g.tshark -i 1 ...