If you combine '-f udp src port 5555' and '-d udp.port=5000,airopeek', it will capture only traffic coming from UDP port 5555, and will decode packets going *to* UDP port 5000 as airopeek packets.

What do you mean by 'as udp 5000 airopeek'? '-d udp.port=5000,airopeek' means 'decode all packets to or from port 5000 using the dissector for the airopeek protocol'.

> and decode them as udp 5000 airopeek, all using t-shark. If you meant '5555', that's 'udp src port 5555'. If you mean '555', the libpcap/WinPcap syntax for that is 'udp src port 555'. > In summary, I need to take packets from udp port 555 It's complaining about your capture filter because you used Wireshark's display filter syntax rather than libpcap/WinPcap's capture filter syntax capture filtering is done by libpcap/WinPcap or, in OSes where they rely on kernel-mode code to do the filtering (Linux, *BSD, Mac OS X, Windows with WinPcap, some others), said code, so the capture filters use that syntax. > tshark -i 1 -f 'udp.srcport = 5555' -b filesize:20480 -b files:2 -d udp.port=5000,airopeek -w wfn-sniffed.cap Its easy enough to do in the gui but T-shark complains about my capture filter. In accordance I need to accept packets from UDP port 5555 and decode it as udp.port=5000,airopeek. > I'm trying to use T-shark to capture my Cisco wireless access point traffic in sniffer mode. On Aug 31, 2011, at 3:29 PM, Steve Evans wrote (twice - I'm replying only to the first message):

Tshark port filter