Can I apply a capture filter to a file I've already saved? Whenever I try this with
I'm using TShark 1.8.12-custom-win64 (SVN Rev 53127 from /trunk-1.8) . Is there another tool that will do what I want, or do I need to learn how to write an equivalent read filter for my capture filter?
|
tcpdump ;-) For windows there is a tool called SplitCap, but the filter syntax is neither capture filter nor display filter. If you prefer a scripted solution, take a look at pcap-util2. It accepts tcpdump capture filters: http://www.badpenguin.co.uk/files/pcap-util2
sure, you can also use 'display/read' filters, and the change in the syntax shouldn't be too complex, at least not for simple capture filters.
++ UPDATE ++
Hint: currently it only supports libpcap files, not pcap-ng files! So, if you want to use WinDump for pcap-ng files, you need to convert them first
Regards I think you meant
(29 Jan '14, 12:19)
multipleinte...
I really meant -Y. There was a change regarding -Y and -R in one of the recent releases.
(29 Jan '14, 12:24)
Kurt Knochner ♦
BTW: see my update in the answer regarding pcap-util2.
(29 Jan '14, 12:25)
Kurt Knochner ♦
Hm, -Y is for display filters, but @multipleinterfaces specifically asked for read filters, so I think it IS in fact "-R".
(29 Jan '14, 23:28)
Jasper ♦♦
Afiak, 'read' filters are display filter syntax. See 'tshark -h'.
(29 Jan '14, 23:47)
Kurt Knochner ♦
From -2 perform a two-pass analysis -R <read filter=""> packet Read filter in Wireshark display filter syntax -Y <display filter=""> packet displaY filter in Wireshark display filter syntax From the code in tshark.c. option -R sets the 'read filter' Now, if I run the following command (1.11.x):
I get the following message.
So, -Y is single pass and -R -r is two-pass. In that respect, -Y should be called the 'read filter' as it is applied only once during the first/single pass, while the file is being read. And -R should be called the 'display filter', as that's the filter that is applied on both passes, which makes it more like a display filter. However, in the code it seems to be vice versa (-Y sets the filter for pass two and -R sets the filter for pass one), or maybe I don't understand the code correctly. Hopefully someone with a better understanding of the code can shed some light on the difference between -Y and -R !?!
(30 Jan '14, 05:32)
Kurt Knochner ♦
showing 5 of 6
show 1 more comments
|