This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark - Filtering UDP SRC port and modifying global header

0

I am using tshark and mergecap to filter and merge a lot of PCAP files into one file for analysis. I have two problems that I can't solve.

1: With tshark, I cannot apply a filter to just the UDP source port. The data has a port that is the same on the source and destination side, so some criteria just pass all data by. Is there a workaround?

2: It seems that after I run tshark, my global header gets modified. I am most concerned about the link type being changed from my application specific type to a maxed out hex field. Is there an option to fix this?

My batch script calls tshark as follows:

tshark -r input.pcap -w output.pcap -Y ip.addr=1.2.3.4 -Y udp.port==12345

asked 05 Aug '14, 11:24

okayh's gravatar image

okayh
1111
accept rate: 0%


One Answer:

0

Replace udp.port by udp.srcport. Not sure to understand what you mean regarding the header content.

answered 05 Aug '14, 12:25

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%