How can I make Wireshark filter by port when reading from standard in?

Question

I'm piping from a RawCap-generated dump file to Wireshark in order to monitor local traffic, how can I instruct wireshark to only show traffic to a certain destination port?

I'm running RawCap in one Cygwin shell, and Wireshark in another to monitor RawCap's output:

Shell 1:

RawCap.exe -f 127.0.0.1 dumpfile.pcap

Shell 2:

# How do I tell Wireshark to show only traffic to port 10000?
tail -c +0 -f dumpfile.pcap | Wireshark.exe -k -i -

Answer 1

The appropriate flag for instructing wireshark to filter the displayed packets is -Y, as its man page reports:

-Y <display filter> start with the given display filter

For filtering the destination port of TCP, use tcp.dstport==X where X specifies the port.

Therefore, the full command is:

tail -c +0 -f dumpfile.pcap | wireshark -k -i - -Y "tcp.dstport==10000"

---

This is a good starting point for information on display filters. A full reference on the subject is available here and a detailed explanation of its syntax is available here. However, it's worth noting that most basic filters can be found via a simple online search.