Specific IP address display filter using tshark

Question

I'm running into issues regarding the use of ip.src as a display filter argument in tshark. The filter works perfectly fine when used with wireshark, I'm not sure if I'm missing something for it's use with tshark though.

In wireshark: ip.src==192.168.0.10

tshark: tshark -r example.pcap -T fields -e frame.time -e ip.src==192.168.0.10 http or http2

The tshark command works fine when just using ip.src to filter the source IP addresses(tshark -r example.pcap -T fields -e frame.time -e ip.src http or http2), it's only when used in order to filter a specific IP address.

I've also tried: tshark -r example.pcap -T fields -e frame.time -e ip.src==192.168.0.0/24 http or http2

Thanks.

Accepted Answer

You can't apply a filter to a -e field output specification, in addition to supply a display filter you must use the -Y option

To print out the ip.src field and filter for ip.src you need something like (untested):

... -e ip.src -Y "ip.src == 192.168.0.10 and (http or http2)"