I expect the filter to filter for packets with an SRT sequence number and sort them in ascending order, as wireshark does. If a name is used, both the port number and protocol are checked. The port can be a number or a name used in /etc/services (see tcp (4P) and udp (4P)). In wireshark the filter is udp.dstport=48220 & srt.seqno and it works. True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a destination port value of port. For -d udp.port=$PORT,srt -d srt.seqno,srt i get tshark: Unknown layer type - srt.seqnovq=Īll throw a list of protocols at me, even though srt is in the list.Filtering expression buttons Following TCP/UDP/SSL streams. For -d udp.port=$PORT&srt.seqno,srt i get tshark: Parameter 'udp.port=46150' doesn't follow the template '=, Picking the best capture point TAPs and switch port mirroring Wiresharks capture.For -d udp.port=$PORT,srt -d srt.seqno i get tshark: Unknown layer type - srt.seqno.Note that what makes it work is changing ip.proto 'http' to http. In the case in the above question, that means setting the filter to: ip.addr192.168.0.201 and http.

If i am using it incorrectly please tell me how, since i have not found any helpful information. If you want to filter to only see the HTTP protocol results of a wireshark capture, you need to add the following filter: http. However the same filter in tshark either does not work, or i am incorrect in my usage. In wireshark, after i decode a bunch of packets as SRT i can then use the filter srt.seqno to filter for only packets with a sequence number and sort them in ascending order.

Wireshark filter udp port