-R works fine, but -w writes all traffic

This issue was migrated from bug 3518 in our old bug tracker.

Original bug information:

Reporter: Andrzej Dopierała
Status: RESOLVED DUPLICATE
Product: Wireshark
Component: TShark
OS: Debian
Platform: x86
Version: 1.0.2

Duplicate of issue #2234

Andrzej Dopierała said:

Build Information:

Compiled with GLib 2.16.6, with libpcap 0.9.8, with libz 1.2.3.3, with POSIX

capabilities (Linux), with libpcre 7.6, without SMI, with ADNS, with Lua 5.1,

with GnuTLS 2.4.2, with Gcrypt 1.4.1, with MIT Kerberos.

Running on Linux 2.6.26-2-vserver-686, with libpcap version 0.9.8.

Built using gcc 4.3.2.

Hi.
I try to get only "sip" traffic from network.
i use
tshark -i eth0 -R 'sip' -S -w x.cap

it show on display only sip traffic (what is ok), but in x.cap is all traffic saw on eth0.

On wireshark 0.9 this works ok.

added clitshark osdebian version1.0 labels

Jeff Morriss said:

*** This bug has been marked as a duplicate of bug #2234 ***

closed