Wireshark mailing list archives
Allowing display filters during capture
From: Avaneesh Kadam <avaneesh.kadam () gmail com>
Date: Thu, 12 Mar 2015 11:37:16 -0700
Can we remove following tshark check?
==
main()
{
if (global_capture_opts.saving_to_file) {
if (dfilter != NULL) {
cmdarg_err("Display filters aren't supported when capturing and
saving the captured packets.);
*return 1; //remove this check to allow DF while capturing.*
* }*
}
}
==
I was looking following command to work:
==
tshark -Y "udp.port==137" -f udp -x -w udp_all.pcap
==
Eg. Above command will capture and save all UDP packets and display only
the ones with port as 137.
By removing above check I could get this to work, although I have not done
thorough testing yet.
I am new to Wireshark development culture, so please let me know if we
discuss such issues here or through bugs.
I did some investigation on why this restriction was put, looks like this
was present from day 1 of display filter (-Y).
--
Thanks,
Avaneesh
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Allowing display filters during capture Avaneesh Kadam (Mar 12)
- Re: Allowing display filters during capture Jeff Morriss (Mar 13)
- Re: Allowing display filters during capture Guy Harris (Mar 13)
- Re: Allowing display filters during capture Sake Blok (Mar 14)
- Re: Allowing display filters during capture Guy Harris (Mar 13)
- Re: Allowing display filters during capture Jeff Morriss (Mar 13)
