getting “Invalid capture filter “subtype probereq” for interface ‘Ethernet” error when trying to save captures directly to csv file

Question

I wanted to store the captures directly to the csv file, for that I used the following command line

tshark -T fields -E separator="," -E header=y -E quote=d -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto subtype probereq

but I am getting the following error:

  Capturing on 'Ethernet'
tshark: Invalid capture filter "subtype probereq" for interface 'Ethernet'.

I also tried adding the name of the file to write in but it didn't help

Answer 1

As the error message states, that is not a valid capture (or display or read) filter.

What is the filter you are using in the gui?

Try to add exactly the same filter, prefixed with either -Y or -R, and you might need quotes.