This is our old Q&A Site. Please post any new questions and answers at

I wrote a tshark display filter as this:

http.request.uri contains "search?q".

It works fine in wireshark with gui in windows. However I get a variety of errors in windows comand-line tshark, like this:

D:\>tshark -r http.pcap -R "http.request.uri contains search?q"
tshark: "?" was unexpected in this context.

D:\>tshark -r http.pcap -R 'http.request.uri contains "search?q"'
tshark: Read filters were specified both with "-R" and with additional command-line arguments

When I remove the "?" from the string, the tshark can print the outcome, but it wasn't the result I want because it prints too much content. I just want the last message from the following list of messages:

D:\>tshark -r http.pcap -R "http.request.uri contains search"
  5   0.464031 -> HTTP 676 GET /complete/search?client=chrome&hl=zh-CN& HTTP/1.1
 62   2.329645 -> HTTP 787 GET /url?sa=p&hl=zh-CN&pref=hkredirect&pval=yes&q= HTTP/1.1
 65   2.465906 -> HTTP 649 GET /searchdomaincheck?format=domain&type=chrome HTTP/1.1
249  10.925213 -> HTTP 862 GET /search?q=%E5%BF%85%E5%BA%94&go=&form=QBLH&qs=n&sk= HTTP/1.1

It seems that the tshark diplay filter doesn't support the special characters like "?", "=". Is there any method that I can include those characters in the display filter?

asked 25 Jul '11, 23:14

calcel's gravatar image

accept rate: 0%

edited 27 Jul '11, 15:41

helloworld's gravatar image


What is the error message you receive?

(26 Jul '11, 00:48) multipleinte...

In windows you have to use double double-quotes to escape the double-quote. The syntax will be:

C:\Download>tshark -r http.cap -R "http.request.uri contains ""search?d"""
 31 7.071765000 -> HTTP 589 GET /search?d HTTP/1.1

C:\Download>tshark -r http.cap -R "http.request.uri contains ""search"""
 31 7.071765000 -> HTTP 589 GET /search?d HTTP/1.1
163 19.888136000 -> HTTP 587 GET /search HTTP/1.1


Hope this helps :-)

permanent link

answered 26 Jul '11, 01:58

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

Thanks a lot. It does solve the problem.

(26 Jul '11, 18:33) calcel
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 25 Jul '11, 23:14

question was seen: 9,777 times

last updated: 27 Jul '11, 15:41

p​o​w​e​r​e​d by O​S​Q​A