Wireshark-dev: Re: [Wireshark-dev] Feature Request for EDITCAP - Selecting by IP Address and Po

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Wed, 30 Jan 2008 11:53:34 -0500
Bill Meier wrote:

I guess not (altho the error message is a bit weird):

     Only read filters, not capture filters, can be specified when
     reading a capture file.

I'm too quick off the mark today.

-f is the switch to specify a capture filter so the error message is correct.

The follow  does seem to work, however:

tshark -r <filename> -R <read-filter> -w <output filename>