I am trying to filter a capture file that was captured by a remote AP. If i pull the file to my laptop i can open in Wireshark decode as peekremote and create the display filter EAPOL to get the packets i want.

However i have about 100Gbs of data on the capture server and i would like to know if i can do this with Tshark or other tool on the linux server directly

Something like this but this just copies the file I just want to output the files to the EAP traffic. Does anyone have any thoughts I am not use to dealing with tshark.

tshark -r capture-18.pcap -J eapol -w test.pcap

1 Answer 1


Sorry after a bit of playing about I worked this out. It was a simple -Y filter

tshark -r in.pcap -Y eapol -w out.pcap

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .