Can you show us the command-line you are using? --gilbert
On 7/2/07, Amit Paliwal <[EMAIL PROTECTED]> wrote:
yes that is what i am saying, when i try to give a filter from Wireshark GUI i am able to do so, but I want the same scenario in command line also....not from GUI. *"Gilbert Ramirez" <[EMAIL PROTECTED]>* Sent by: [EMAIL PROTECTED] 07/02/2007 11:31 AM Please respond to Developer support list for Wireshark <[email protected]> To "Developer support list for Wireshark" <[email protected]> cc Subject Re: [Wireshark-dev] filter expression required A pcap filter? You mean a capture file? The pcap/capture filter syntax does not provide a 'contains' keyword, so it's not possible. You can only use 'contains' in the display filter syntax, which is unique to wireshark (and tshark, etc.) --gilbert On 7/2/07, *Amit Paliwal* <[EMAIL PROTECTED]<[EMAIL PROTECTED]>> wrote: yes i am using 'contains' keyword, and i am giving name of my protocol which is a string..... i am running it on Windows and i used 'udp contains my_protocol' also but its not working....... i need to give filter expressions defined by pcap, but i am not getting any documentation of it. *"Gilbert Ramirez" <[EMAIL PROTECTED] <[EMAIL PROTECTED]>*>* Sent by: [EMAIL PROTECTED]<[EMAIL PROTECTED]> 07/02/2007 11:15 AM Please respond to Developer support list for Wireshark <[EMAIL PROTECTED]<[email protected]> > To "Developer support list for Wireshark" <[EMAIL PROTECTED]<[email protected]> > cc Subject Re: [Wireshark-dev] filter expression required You're really using the "contains" keyword? That's for strings and binary strings. The spaces in your filter are probably confusing the shell when you invoke wireshark/tshark from the command-line. Are you running on Unix? Use single quotes around your filter: tshark ............ 'udp contains xxx' --gilbert On 7/2/07, Amit Paliwal <[EMAIL PROTECTED]<[EMAIL PROTECTED]>> wrote: > > I want to set command line filter expression for proprietary protocol that > is registered over UDP by its name. I am able to do it directly in Wireshark > GUI by setting the expression as "UDP contains my_protocol", but I need to > do the same from command line that I am unable to do right now. > > Please suggest. > > Regards, > > ______________________________________________________________________ > > _______________________________________________ > Wireshark-dev mailing list > [EMAIL PROTECTED] <[email protected]> > *http://www.wireshark.org/mailman/listinfo/wireshark-dev*<http://www.wireshark.org/mailman/listinfo/wireshark-dev> > > _______________________________________________ Wireshark-dev mailing list* [EMAIL PROTECTED] <[email protected]>* **http://www.wireshark.org/mailman/listinfo/wireshark-dev*<http://www.wireshark.org/mailman/listinfo/wireshark-dev> ______________________________________________________________________ ______________________________________________________________________ _______________________________________________ Wireshark-dev mailing list* [EMAIL PROTECTED] <[email protected]>* **http://www.wireshark.org/mailman/listinfo/wireshark-dev*<http://www.wireshark.org/mailman/listinfo/wireshark-dev> ______________________________________________________________________ _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev ______________________________________________________________________ _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
_______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
