On Tue, Jul 11, 2006 at 10:16:59AM +0800, Jeff Morriss wrote:
>
> > Background: I want to set up 2-3 instances of Wireshark which read the
> > dumpfile but display only parts of the traffic by employing filters.
> >
> > Are there other solutions?
>
> Hmmm, not that I can think of (other than doing all your filtering after
> the capture is done which is obviously not what you want).
If your system can handle it, you can start 2-3 instances of wireshark, all
capturing on the same interface, but each with a different capture- and/or
display filter applied.
If one system can't handle it, you might want to add a hub to repeat the
ethernet frames to multiple hosts, each having their own filters ;)
Cheers, Sake