This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I wanted to store the captures directly to the csv file, for that I used the following command line

tshark -T fields -E separator="," -E header=y -E quote=d -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto subtype probereq

but I am getting the following error:

  Capturing on 'Ethernet'
tshark: Invalid capture filter "subtype probereq" for interface 'Ethernet'.

I also tried adding the name of the file to write in but it didn't help

asked 05 Jun '17, 05:00

dr_dr_'s gravatar image

dr_dr_
1222
accept rate: 0%

What network interface are you capturing on? What version, of what operating system, is the machine on which you're capturing running?

(06 Jun '17, 20:24) Guy Harris ♦♦

As the error message states, that is not a valid capture (or display or read) filter.

What is the filter you are using in the gui?

Try to add exactly the same filter, prefixed with either -Y or -R, and you might need quotes.

permanent link

answered 05 Jun '17, 05:24

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×549
×40

question asked: 05 Jun '17, 05:00

question was seen: 1,377 times

last updated: 06 Jun '17, 20:24

p​o​w​e​r​e​d by O​S​Q​A