This is a static archive of our old Q&A Site. Please post any new questions and answers at

Filtering by mac is not working.


Hello everybody!

I'm trying to filter a pcap file using the following command and filter:

tshark -q -r capture.pcap -z io,stat,0,eth.addr==aa:bb:cc:dd:ee:ff

But I'm getting this error:

tshark: invalid "-z io,stat,<interval>[,<filter>][,<filter>]..." argument

Does anyone know what I'm doing wrong? Whether I use an ip filter (e.g. ip.addr== the result is ok.


asked 05 Dec '16, 07:17

JohannesFerreira's gravatar image

accept rate: 0%

edited 05 Dec '16, 11:04

grahamb's gravatar image

grahamb ♦

Works for me, what version of tshark and what shell are you running this in?

(05 Dec '16, 09:05) grahamb ♦

Hi grahamb, thanks for your quickly answer. I'm using terminator as shell and the version is "TShark (Wireshark) 2.2.2". I tried in a different PC and it worked, I'm wondering if it could be some library version. Any idea?

TShark (Wireshark) 2.2.2 (Git Rev Unknown from unknown)

Copyright 1998-2016 Gerald Combs [email protected] and contributors. License GPLv2+: GNU GPL version 2 or later This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.48.1, with zlib 1.2.8, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.2.4, with GnuTLS 3.4.10, with Gcrypt 1.6.5, with MIT Kerberos, with GeoIP, with nghttp2 1.7.1.

Running on Linux 4.4.0-51-generic, with locale LC_CTYPE=pt_BR.UTF-8, LC_NUMERIC=pt_BR.UTF-8, LC_TIME=pt_BR.UTF-8, LC_COLLATE=en_US.UTF-8, LC_MONETARY=pt_BR.UTF-8, LC_MESSAGES=en_US.UTF-8, LC_PAPER=pt_BR.UTF-8, LC_NAME=pt_BR.UTF-8, LC_ADDRESS=pt_BR.UTF-8, LC_TELEPHONE=pt_BR.UTF-8, LC_MEASUREMENT=pt_BR.UTF-8, LC_IDENTIFICATION=pt_BR.UTF-8, with libpcap version 1.7.4, with GnuTLS 3.4.10, with Gcrypt 1.6.5, with zlib 1.2.8.

Built using gcc 5.4.0 20160609.

(05 Dec '16, 10:21) JohannesFerr...

Did you use the same shell on the other PC? I'm clutching at straws that it's an argument escaping error.

(05 Dec '16, 11:03) grahamb ♦

Yes, I used and I also tried a different shell, same thing.

(05 Dec '16, 11:26) JohannesFerr...

Do you know what library is responsible to parse the eth parameters?

(05 Dec '16, 11:27) JohannesFerr...

One Answer:


I tried in a different PC and it works ok. Thanks for your time grahamb!!

answered 06 Dec '16, 02:37

JohannesFerreira's gravatar image

accept rate: 0%