wireshark 在 linux command line 設 capture filter

記錄一下怕忘記又要再翻一次文件 XD

capture filter 跟 read filter 是兩個不同的東西,語法也不同 Orz

tshark -f “tcp port 80 and host 123.456.789.1” -i eth0 -w /tmp/hahaha.cap

只收 port 80 且 host 是 123.456.789.1 的 packet


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.