Revision history [back]
Using tshark to capture and Read filter at the same time
Is it possible to use tshark to capture and Read the filter at the same time
To Read, i use the below command line
tshark -i any -R "" ex: tshark -i any -R "dns"
To Write into a capture file
tshark -i any -w "dns.pcap"
I am not able to combine them both into one as i get below error
tshark: -R without -2 is deprecated. For single-pass filtering use -Y. tshark: Read filters aren't supported when capturing and saving the captured packets.
Is there any better ways to try this to minimize my effort of Running two different command?