• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 719
  • Last Modified:

Need help with a tshark filter.

I am using Wireshark to capture network traffic to a file, using the filter 'no arp no broadcast no multicast host 10.20.30.40'.  I would like to use tshark to do the capture to a file instead.  This same filter generates errors when it is used in tshark.  What would the equivalent Tshark filter be?
0
CousinDupree
Asked:
CousinDupree
  • 2
  • 2
1 Solution
 
Hugh FraserConsultantCommented:
The syntax should be:

not arp and not broadcast and not multicast and host 10.20.30.40
0
 
CousinDupreeAuthor Commented:
My apologies, 'not arp and not broadcast and not multicast and host 10.20.30.40' is indeed the filter that I am using.  It doesn't work in Tshark, however.
0
 
Hugh FraserConsultantCommented:
This is the correct syntax for the filter, if that's where the problem is. What error are you getting?
0
 
CousinDupreeAuthor Commented:
My command line syntax was incorrect, your answer was correct..  Thanks for the help!
0

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now