Capture filter ignored when reading from stdin

This issue was migrated from bug 8263 in our old bug tracker.

Original bug information:

Reporter: Tore Anderson
Status: RESOLVED DUPLICATE
Product: Wireshark
Component: TShark
OS: Fedora
Platform: x86-64
Version: 1.8.4

Duplicate of issue #1814

Tore Anderson said:

Build Information:

wireshark-1.8.4-1.fc18.x86_64

When capture from standard in with "-i -", the specified capture filter is ignored, and all packets are displayed (or written to outfile).

Reproducing it is easy, e.g.:

$ tcpdump -U -i eth0 -w - tcp | tshark -i - -f "not tcp"

This should never have captured any packets whatsoever, as the two filters cancel each other out. However all TCP traffic on eth0 gets displayed.

added clitshark osfedora version1.8 labels

Jeff Morriss said:

*** This bug has been marked as a duplicate of bug #1814 ***

closed