Capture Filter (tshark -f): BPF syntax
Display Filter (tshark -Y): Wireshark syntax

Wireshark Wiki: Capture Filters
Ask Wireshark: what is the difference between capture filter and display filter?
Ask Wireshark: Changing Display Filter to Capture Filter


Tshark column fields
Bug 10201 – col.Protocol missing from tshark 1.11.3 and 1.12.0-rc2

# tshark -i re0 -T fields -e frame.number -e ip.addr -e udp -e _ws.col.info
Capturing on 're0'
44,        User Datagram Protocol, Src Port: 55317 (55317), Dst Port: 5355 (5355)
45,     User Datagram Protocol, Src Port: 1900 (1900), Dst Port: 1900 (1900)


Troubleshooting with Wireshark – Virtual Tour

Leave a Reply

Your email address will not be published. Required fields are marked *