Wireshark-users: Re: [Wireshark-users] tshark escape character

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Sake Blok <sake@xxxxxxxxxx>
Date: Mon, 14 Sep 2009 07:44:57 +0200
On Sun, Sep 13, 2009 at 10:08:18PM -0400, Kvetch wrote:
> Hello, how can I properly escape a character in a tshark contains
> string?  My filter has a forward slash in it which appears to be
> throwing tshark off .  The filter is -- http contains
> "application/octet-stream" but the / is breaking the command.  Kicking
> back an error stating
> tshark: "/" was unexpected in this context.

You could use:

tshark -r http.cap -R 'http contains "application/octet-stream"'  

Cheers,


Sake