This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

capture filter default

0

Hello, How can I configure wireshark to have custom, default capture filter? There is option -f for wireshark which lets read custom filter by wireshark, but I could not find how to make this filter in required format (libpcap). Im not programist and I dont know how to play with pcap_compile. Is there an painless way for preparing this filter? Regards, R

asked 03 Jul '13, 04:45

rafal's gravatar image

rafal
1●1●1●1
accept rate: 0%

One Answer:

0

but I could not find how to make this filter in required format (libpcap).

I'm not sure if I understand your question, but the capture filter format is defined here

http://www.manpagez.com/man/7/pcap-filter/

Regards
Kurt

answered 03 Jul '13, 06:14

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Hi, Thanks Kurt, I read it already. It finally started working for me. The easiest way to have it in default value is to make shell script or bat file with predefined filter. BR, Rafal

(05 Jul '13, 05:43) rafal