Revision history [back]
What about just opening the pcap file using a Read Filter (File -> Open -> File name: foo.pcap, Read filter: tcp.stream eq 0)?
The equivalent of this in tshark is:
tshark -r foo.pcap -2R "tcp.stream == 0"
What about just opening the pcap file using a Read Filter (File -> Open -> File name: foo.pcap, Read filter: tcp.stream eq 0)?
The equivalent of this in tshark is:
tshark -r foo.pcap -2R "tcp.stream == 0"