This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display filter with white spaces

0

Hi,

I am trying to launch the Wireshark through command line as:

wireshark -r mycapture.pcap -R "frame.time eq Nov 2, 2010 18:49:42.000710000"

Its giving an error:

2" was unexpected in this context.

The filter expression "frame.time == Nov 2, 2010 18:49:42.000710000" isn't a valid display filter.

It seems like the white space is causing the problem. Any suggestions how to do this?

Thanks, Puneet

asked 16 Jun '11, 06:02

PuneetNay's gravatar image

PuneetNay
1112
accept rate: 0%

edited 16 Jun '11, 11:39

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


One Answer:

2

Try this:

wireshark -r mycapture.pcap -R "frame.time eq \"Nov 2, 2010 18:49:42.000710000\""

answered 16 Jun '11, 06:31

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

It works! Thanks a ton!

(16 Jun '11, 19:37) PuneetNay