Wireshark-users: Re: [Wireshark-users] filter on packet size ?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "j.snelders" <j.snelders@xxxxxxxxxx>
Date: Fri, 20 Aug 2010 20:43:19 +0200
Hi Janos,

Wireshark
Display filter: frame.cap_len >= 240 && frame.cap_len <=325

TShark
$ tshark -r test.pcap -R "frame.cap_len >= 240 && frame.cap_len <=325" -w
frame.cap_len.pcap

Best regards
Joke

On Fri, 20 Aug 2010 14:16:55 -0400 J?nos L?bb wrote:
>Hi,
>
>How can I filter out packets from a capture file, which have a certain size
>- let's say between 5180 and 10000 bytes?
>
>Thanks ahead,
>
>J?nos