THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 2
Jaap's avatar
13.7k
Jaap
updated 2019-12-16 11:34:21 +0000

Assuming that the filter has been correctly transcribed from the GUI, it's a quoting issue that the GUI filter box doesn't have to deal with. Try this:

tshark -i en01 -f 'sip.From == "sipp <sip:[email protected]:5060>;tag=21633SIPpTag0015893"'

Note that the filter now has outer single quotes for bash and inner double quotes for tshark.

Revision 1
grahamb's avatar
23.8k
grahamb
answered 2019-12-16 11:04:35 +0000

Assuming that the filter has been correctly transcribed from the GUI, it's a quoting issue that the GUI filter box doesn't have to deal with. Try this:

tshark -i en01 -f 'sip.From == "sipp <sip:[email protected]:5060>;tag=21633SIPpTag0015893"'

Note Not that the filter now has outer single quotes for bash and inner double quotes for tshark.