There's a distinction between capture filters and display filters. They use different syntaxes. See:
http://www.wireshark.org/faq.html#q7.7 You *can* use display filters with tethereal, but be warned that display filters are slower than capture filters. Use "-R" instead of "-f" --gilbert On 12/19/06, david lopez <[EMAIL PROTECTED]> wrote: > Hello I'm trying to use this filter 'tns.data_flag.rts' to capture only > RTS/CTS packets > > I'm typing this in my shell: tethereal -i ath0 -c 500 -f tns.data_flag.rts > > An d I'm grtting the next error messege: Unable to parse the capture filter > string (syntax error). Interestingly enough, this lools like a valid display > filter. Are you sure you didn't mixthem up > > Can somebody help me? > > Thank you > _______________________________________________ > Wireshark-dev mailing list > [email protected] > http://www.wireshark.org/mailman/listinfo/wireshark-dev > > _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
