Capturing same interface with tshark with same or different capture filters
- by Pankaj Goyal
I am in stuck in a situation where an interface will be captured more than one time.
Like :-
$ tshark -i rpcap://1.1.1.1/lo -f "ip proto 1" -i rpcap://1.1.1.1/lo -f "ip proto 132"
or
(same filter)
$ tshark -i rpcap://1.1.1.1/lo -f "ip proto 1" -i rpcap://1.1.1.1/lo -f "ip proto 1"
what will happen in both the cases ?
In first case, will the capture filter gets OR'ed or AND'ed ??
In second case, will the same packets be captured two times ?