-1

I want to use Tshark as a subprocess and I need to define a flow to display its packets, but I don't know the cmd to define a flow in tshark, just I know it in wireshark: 

ip.src == ipAddr and ip.dst == ipAddrDst and udp.srcport == 33191 and udp.dstport == 2003 ;

So can you help me to find the equivalent cmd in tshark?

Brian Tompsett - 汤莱恩
  • 5,753
  • 72
  • 57
  • 129
Hafsa Sedrati
  • 5
  • 4

1 Answers1

0

You need to use tcpdump's syntax:

tshark "ip and udp and src host ipAddr and dst host ipAddrDst \
        and src port 33191 and dst port 2003"
pchaigno
  • 11,313
  • 2
  • 29
  • 54