This is our old Q&A Site. Please post any new questions and answers at

In wireshark there is an option "Export specified packets". How can I do this in thsark? Is there a command that can export/save filtred packets in a new .pcap file?

asked 03 Sep '14, 01:42

anhtuan's gravatar image

accept rate: 0%

There are tshark commands that can, given a filter in the "display filter" syntax", read a capture file and write out to another file the packets matched by the filter, such as

tshark -Y {filter} -r {input file} -w {output file}


tshark -2 -R {filter} -r {input file} -w {output file}

The second example is more like "Export specified packets" with {filter} as the display filter and with "All packets" and "Displayed" selected, although it's slower as it has to read the file twice.

You can also use editcap if you want to select the packets using ranges of packet numbers rather than a filter.

permanent link

answered 03 Sep '14, 22:04

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Thanks! This solved my problem.

(04 Sep '14, 00:59) anhtuan
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 03 Sep '14, 01:42

question was seen: 8,293 times

last updated: 04 Sep '14, 00:59

p​o​w​e​r​e​d by O​S​Q​A