Search code examples
command-linepacket-capturetshark

tshark: apply filter then output a fixed number of packets


I would like to use one tshark command that would: open a capture file, apply a filter to its contents and then output a fixed number of resulting packets. Currently, I have come up with

tshark -r <infile> -Y <display filter> -w <outfile> -c <number of packets>

The problem is that -c <number of packets> works before the display filter is applied, i.e. it applies the <display filter> to the first <number of packets> of the original capture file which is not what I want. How do I reverse the order? I've been reading the manpage with no luck so far.


Solution

  • TShark:
    tshark -r server_01.pcapng -l -Y dns > tshark -c 100 -w server_01_dns100.pcapng