I wrote a tshark display filter as this:
It works fine in wireshark with gui in windows. However I get a variety of errors in windows comand-line tshark, like this:
When I remove the "?" from the string, the tshark can print the outcome, but it wasn't the result I want because it prints too much content. I just want the last message from the following list of messages:
It seems that the tshark diplay filter doesn't support the special characters like "?", "=". Is there any method that I can include those characters in the display filter? |
In windows you have to use double double-quotes to escape the double-quote. The syntax will be:
Hope this helps :-) Thanks a lot. It does solve the problem.
(26 Jul '11, 18:33)
calcel
|
What is the error message you receive?