Re: [Ethereal-users] writing to disk process

[Ulf Lamping <ulf.lamping@xxxxxx>]

Torres, Javier wrote:
> Thanks for that, I have not read anything on this exe, does it have the
> same syntax for filters and the like?
>   
Basically yes.

However, you can use capture filters, which are basically a feature of 
libpcap/WinPcap. But you can't use read filters, the ones with Wireshark 
display filter syntax as that would require a lot of additional 
performance and makes packet drops much more likely.

See http://www.wireshark.org/docs/man-pages/dumpcap.html for details.

Regards, ULFL