On Dec 5, 2009, at 11:40 AM, sean bzd wrote:
Probably a dump question
Yes, it's definitely a question about dumps of network traffic, so
it's a dump question. It's not a dumb question, however. :-)
but is there a concept of display filter without using wireshark
GUI? Meaning that I'm capturing traffic using dumpcap using some
capture filter. Is there a way to filter further (like a display
filter)
How about a display filter?
frame contains 04:02:ff:01:32
without loading the .pcap file in the wireshark?
How about using TShark with that filter expression as a "read filter",
to check whether a given capture file has a packet containing that
sequence of bytes?