When I do something like:
wireshark.exe -k -i Ethernet -f udp -R dns
wireshark.exe -k -i Ethernet -f udp --read-filter dns
My assumption would be that it would start a new capture on Ethernet with a display filter of DNS. But I don't have any display filter selected in the display filter area when the capture loads up. Am I misunderstanding this option?
Windows 10 22H2, 4.2.3 x64
Could it be that you want a display filter instead of a read filter?
From the Wireshark man page:
-R|--read-filter <read (display)="" filter=""> When reading a capture file specified with the -r flag, ...
-Y|--display-filter <display filter=""> Start with the given display filter.
Oh yes, that's what I was looking for, thanks. Not sure what the read filter is for now though. Maybe it's meant to apply to file inputs. I'll have to play around with that sometime.
As per the man page, a "read filter" filters packets using display filter syntax, any that are excluded by the filter are discarded and not present in the output.
A display filter does not affect the packets in the capture, only those that are displayed.
Comments