Okay, so that's a capture filter, and it won't work. Capture filters (-f)
use pcap syntax, while display filters (used *after* the capture is made)
use wireshark syntax.
You should be able to use -R instead of -f, but note that this uses more
processing than -f, so if the packets are coming in fast, you might lose
some.
If you can use a UDP port number, then you can use -f 'udp port XXX' as your
capture filter.
--gilbert
On 7/2/07, Amit Paliwal <[EMAIL PROTECTED]> wrote:
*Command line:-* wireshark -i
\Device\NPF_{52EFAA93-34C5-4F7E-80AE-638A48E3F1BD} -k -f UDP
but I want something like
*Command line:-* wireshark -i
\Device\NPF_{52EFAA93-34C5-4F7E-80AE-638A48E3F1BD} -k -f *UDP contains
my_protocol*
*so that only my_protocol gets sniffed.*
*"Gilbert Ramirez" <[EMAIL PROTECTED]>*
Sent by: [EMAIL PROTECTED]
07/02/2007 11:47 AM
Please respond to
Developer support list for Wireshark <[email protected]>
To
"Developer support list for Wireshark" <[email protected]> cc
Subject
Re: [Wireshark-dev] filter expression required
Can you show us the command-line you are using?
--gilbert
On 7/2/07, *Amit Paliwal* <[EMAIL PROTECTED] *<[EMAIL PROTECTED]>>
wrote:
yes that is what i am saying, when i try to give a filter from Wireshark
GUI i am able to do so, but I want the same scenario in command line
also....not from GUI.
*"Gilbert Ramirez" <[EMAIL PROTECTED] <[EMAIL PROTECTED]>*>*
Sent by: [EMAIL PROTECTED]<[EMAIL PROTECTED]>
07/02/2007 11:31 AM
Please respond to
Developer support list for Wireshark <[EMAIL
PROTECTED]<[email protected]>
>
To
"Developer support list for Wireshark" <[EMAIL
PROTECTED]<[email protected]>
> cc
Subject
Re: [Wireshark-dev] filter expression required
A pcap filter? You mean a capture file? The pcap/capture filter syntax
does not provide a 'contains' keyword, so it's not possible. You can only
use 'contains' in the display filter syntax, which is unique to wireshark
(and tshark, etc.)
--gilbert
On 7/2/07, *Amit Paliwal* <[EMAIL PROTECTED] *<[EMAIL PROTECTED]>>
wrote:
yes i am using 'contains' keyword, and i am giving name of my protocol
which is a string.....
i am running it on Windows and i used 'udp contains my_protocol' also but
its not working.......
i need to give filter expressions defined by pcap, but i am not getting
any documentation of it.
*"Gilbert Ramirez" <[EMAIL PROTECTED] <[EMAIL PROTECTED]> *>*
Sent by: [EMAIL PROTECTED] *<[EMAIL PROTECTED]>
07/02/2007 11:15 AM
Please respond to
Developer support list for Wireshark <[EMAIL PROTECTED]
*<[email protected]>
>
To
"Developer support list for Wireshark" <[EMAIL PROTECTED]
*<[email protected]>
> cc
Subject
Re: [Wireshark-dev] filter expression required
You're really using the "contains" keyword? That's for strings and
binary strings.
The spaces in your filter are probably confusing the shell when you
invoke wireshark/tshark from the command-line. Are you running on
Unix? Use single quotes around your filter:
tshark ............ 'udp contains xxx'
--gilbert
On 7/2/07, Amit Paliwal <[EMAIL PROTECTED] *<[EMAIL PROTECTED]>>
wrote:
>
> I want to set command line filter expression for proprietary protocol
that
> is registered over UDP by its name. I am able to do it directly in
Wireshark
> GUI by setting the expression as "UDP contains my_protocol", but I need
to
> do the same from command line that I am unable to do right now.
>
> Please suggest.
>
> Regards,
>
> ______________________________________________________________________
>
> _______________________________________________
> Wireshark-dev mailing list
> [EMAIL PROTECTED] <[email protected]>
> *http://www.wireshark.org/mailman/listinfo/wireshark-dev
*<http://www.wireshark.org/mailman/listinfo/wireshark-dev>
>
>
_______________________________________________
Wireshark-dev mailing list*
[EMAIL PROTECTED] <[email protected]> *
**http://www.wireshark.org/mailman/listinfo/wireshark-dev
*<http://www.wireshark.org/mailman/listinfo/wireshark-dev>
______________________________________________________________________
______________________________________________________________________
_______________________________________________
Wireshark-dev mailing list*
[EMAIL PROTECTED] <[email protected]> *
**http://www.wireshark.org/mailman/listinfo/wireshark-dev
*<http://www.wireshark.org/mailman/listinfo/wireshark-dev>
______________________________________________________________________
_______________________________________________
Wireshark-dev mailing list*
[EMAIL PROTECTED] <[email protected]>*
**http://www.wireshark.org/mailman/listinfo/wireshark-dev*<http://www.wireshark.org/mailman/listinfo/wireshark-dev>
______________________________________________________________________
_______________________________________________
Wireshark-dev mailing list*
[EMAIL PROTECTED] <[email protected]>*
**http://www.wireshark.org/mailman/listinfo/wireshark-dev*<http://www.wireshark.org/mailman/listinfo/wireshark-dev>
______________________________________________________________________
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
______________________________________________________________________
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
