I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get:

enter image description here Using:

tshark -x -r Run18.pcapng -f dst

Is there a way round this or is there some other tool that could do it - ideally producing the same sort of output (bytes and text)?

  • 2
    It very much helps if you copy and paste text into here, rather than an image. Then you can format with {} and it's searchable and copyable by others.
    – jonathanjo
    Nov 7, 2018 at 11:15

1 Answer 1


Tshark is actually extremely powerful for filtering, and has two kinds: capture filters wih -f and display filters with -Y

Tshark documentation says:

Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port == 80). The former are much more limited and are used to reduce the size of a raw packet capture. The latter are used to hide some packets from the packet list.


Your pcap files already have been captured, which means that you don't use a capture filter on them, you use a display filter.

$ tshark -r TCPD -Y 'ip.dst =='
    1   0.000000 →  ICMP 98 Echo (ping) request  id=0x4292, seq=1/256, ttl=64

Note the quotes to protect the filter from the shell.

  • Thanks for the hint - eventually got it working with this (since I needed it from a capture): tshark -x -r Run18.pcapng "ip.dst =="
    – Robbie Dee
    Nov 7, 2018 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.