[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wireshark-dev
Subject:    Re: [Wireshark-dev] Capture Filter Equivalent of tshark -d optino!
From:       "Gilbert Ramirez" <gram () alumni ! rice ! edu>
Date:       2007-11-28 5:58:24
Message-ID: 924cf7f40711272158jbbf161u50b1caf49b44c055 () mail ! gmail ! com
[Download RAW message or body]

A capture filter will just limit which packets are saved to a file.
You can do that with this capture filter:

udp port 21000

The capture filter, however, will not set up your "decode as" option;
you need to do that outside the capture filter.

--gilbert

On 11/28/07, Jack Liou <jwliou95@gmail.com> wrote:
> Hi,
>
> I am currently using tshark's  "-d udp.port==21000,rtp" option to tell
> tshark to treat UDP diagram on port 21000 as RTP packets. Can the same thing
> be done in capture filter. I know its doable on a captured file by using the
> "Decode As" feature. But can it being done in capture or display filters?
> Thanks for the help!
>
> Jack
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@wireshark.org
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
>
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@wireshark.org
http://www.wireshark.org/mailman/listinfo/wireshark-dev

[prev in list] [next in list] [prev in thread] [next in thread]