This is our old Q&A Site. Please post any new questions and answers at

I'm running into issues regarding the use of ip.src as a display filter argument in tshark. The filter works perfectly fine when used with wireshark, I'm not sure if I'm missing something for it's use with tshark though.

In wireshark: ip.src==

tshark: tshark -r example.pcap -T fields -e frame.time -e ip.src== http or http2

The tshark command works fine when just using ip.src to filter the source IP addresses(tshark -r example.pcap -T fields -e frame.time -e ip.src http or http2), it's only when used in order to filter a specific IP address.

I've also tried: tshark -r example.pcap -T fields -e frame.time -e ip.src== http or http2


asked 27 Aug '15, 13:11

tbm's gravatar image

accept rate: 0%

edited 27 Aug '15, 13:11

You can't apply a filter to a -e field output specification, in addition to supply a display filter you must use the -Y option

To print out the ip.src field and filter for ip.src you need something like (untested):

... -e ip.src -Y "ip.src == and (http or http2)"
permanent link

answered 27 Aug '15, 13:55

grahamb's gravatar image

grahamb ♦
accept rate: 22%

Thanks! Works perfectly!

(27 Aug '15, 14:18) tbm
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 27 Aug '15, 13:11

question was seen: 27,047 times

last updated: 27 Aug '15, 14:18

p​o​w​e​r​e​d by O​S​Q​A