Wireshark-bugs: [Wireshark-bugs] [Bug 9161] TShark read filters for tcp.analysis.* don't work
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 18 Sep 2013 01:19:23 +0000

Comment # 1 on bug 9161 from 
(In reply to comment #0)
> Attempting to use any TShark tcp.analysis.{whatever} read filters doesn't
> write results out to a file.
> 
> Example:
> tshark -r 00000_20130912135745.cap -q tcp.analysis.window_full ||
> tcp.analysis.zero_window -w tcp.analysis.cap

Your syntax is wrong there, was that just a typo?

Did you try:

    tshark -r 00000_20130912135745.cap -2R "tcp.analysis.window_full ||
tcp.analysis.zero_window" -w tcp.analysis.cap

or:

    tshark -r 00000_20130912135745.cap -Y "tcp.analysis.window_full ||
tcp.analysis.zero_window" -w tcp.analysis.cap

You are receiving this mail because:
  • You are watching all bug changes.