Wireshark mailing list archives
Allowing display filters during capture
From: Avaneesh Kadam <avaneesh.kadam () gmail com>
Date: Thu, 12 Mar 2015 11:37:16 -0700
Can we remove following tshark check? == main() { if (global_capture_opts.saving_to_file) { if (dfilter != NULL) { cmdarg_err("Display filters aren't supported when capturing and saving the captured packets.); *return 1; //remove this check to allow DF while capturing.* * }* } } == I was looking following command to work: == tshark -Y "udp.port==137" -f udp -x -w udp_all.pcap == Eg. Above command will capture and save all UDP packets and display only the ones with port as 137. By removing above check I could get this to work, although I have not done thorough testing yet. I am new to Wireshark development culture, so please let me know if we discuss such issues here or through bugs. I did some investigation on why this restriction was put, looks like this was present from day 1 of display filter (-Y). -- Thanks, Avaneesh
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Allowing display filters during capture Avaneesh Kadam (Mar 12)
- Re: Allowing display filters during capture Jeff Morriss (Mar 13)
- Re: Allowing display filters during capture Guy Harris (Mar 13)
- Re: Allowing display filters during capture Sake Blok (Mar 14)
- Re: Allowing display filters during capture Guy Harris (Mar 13)
- Re: Allowing display filters during capture Jeff Morriss (Mar 13)