Filter
Capture Filter (tshark -f): BPF syntax
Display Filter (tshark -Y): Wireshark syntax
Wireshark Wiki: Capture Filters
Ask Wireshark: what is the difference between capture filter and display filter?
Ask Wireshark: Changing Display Filter to Capture Filter
TShark
Tshark column fields
Bug 10201 – col.Protocol missing from tshark 1.11.3 and 1.12.0-rc2
# tshark -i re0 -T fields -e frame.number -e ip.addr -e udp -e _ws.col.info Capturing on 're0' [...] 44 172.21.5.130,224.0.0.252 User Datagram Protocol, Src Port: 55317 (55317), Dst Port: 5355 (5355) 45 172.21.5.69,239.255.255.250 User Datagram Protocol, Src Port: 1900 (1900), Dst Port: 1900 (1900)
Video