starting capture from the command line with a display filter active

Question

I have tried using the -R option but it seems it is only for reading previously captured files? Is there anyway of doing this please. I have just downloaded latest stable version 1.6.0 and rebuilt on centos 5.5.

e.g. wireshark -i bond0 -R tcp.port==8600 -k and whatever else options etc

I found a faq with someone offering a solution (which was admitted that it did not work) with hope someone would answer.

any ideas most greatful

Answer 1

To confirm, the man-page for wireshark suggests that -R is only for reading capture files.

-R {read (display) filter}
When reading a capture file specified with the -r flag, causes the specified filter (which uses the syntax of display filters, rather than that of capture filters) to be applied to all packets read from the capture file; packets not matching the filter are discarded.

EDIT: If you're building Wireshark, you might as well add code to allow setting the display filter for live captures. See funnel_set_filter and funnel_apply_filter for examples of how to set a display filter.