Using tshark to capture and Read filter at the same time

Is it possible to use tshark to capture and Read the filter at the same time

To Read, i use the below command line

tshark -i any -R "<any protocol="">" ex: tshark -i any -R "dns"

To Write into a capture file

tshark -i any -w "dns.pcap"

I am not able to combine them both into one as i get below error

tshark: -R without -2 is deprecated. For single-pass filtering use -Y. tshark: Read filters aren't supported when capturing and saving the captured packets.

Is there any better ways to try this to minimize my effort of Running two different command?

h4harshith's avatar
1
h4harshith
asked 2018-04-24 05:38:33 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments