This is our old Q&A Site. Please post any new questions and answers at

Hi, I have a very huge trace file, how can I filter on TSHARK the next data.

expert.message == "Duplicate ACK (#1)" || expert.message == "Duplicate ACK (#2)" || expert.message == "Duplicate ACK (#3)" || expert.message == "Duplicate ACK (#4)"

I would like to do it with tshark because this trace file is so large to open it with wireshark and It will be paintfull to split the file and open one by one and apply the filter on Wireshark I can't find any reference about filter expert.messages or something like that.


asked 10 Nov '11, 11:04

l0k1's gravatar image

accept rate: 0%

You can use tshark's -R argument to apply a display filter to the file.

tshark -r <infile.cap> -R 'expert.message == "Duplicate ACK (#1)" || expert.message == "Duplicate ACK (#2)"'

You will have to be careful about are the single vs. double quotes. If you use -R ' <filter> ' (single quotes around the whole thing) and then use " (double quotes) inside <filter> you should be all set.

permanent link

answered 10 Nov '11, 11:25

zachad's gravatar image

accept rate: 21%

Dude,,, awsome. It works like a charm


Daniel Castillo

(10 Nov '11, 11:32) l0k1
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 10 Nov '11, 11:04

question was seen: 4,326 times

last updated: 10 Nov '11, 13:02

p​o​w​e​r​e​d by O​S​Q​A