title: Recursively Filter directory of .cap/.pcap Files With tshark
body: <p>I am trying to apply a <code>Wireshark</code> filter to a directory of <code>.cap</code> files created by <code>tcpdump</code>. I have about a 1000 .cap files awaiting filtering (we are intentionally capturing without filters to ensure we have all the data we need in case our hypothesis doesn't pan out). I cannot find any references to folks using <code>tshark</code> to recursively read a file, apply the filter, write out a new <code>.cap</code> file, then move on to the next, rinse, repeat. </p>
  
  <p>My set up:</p>
  
  <p><code>Tcpdump</code> is dumping traffic and rolling to a new file once the file reaches <code>1GB</code> (yes, huge for pcaps). Just for reference, this is the <code>tcpdump</code> command I'm using:</p>
  
  <pre><code>sudo tcpdump -q -i &lt;INTERFACE&gt; -w path/to/capfile.cap -C 1000 -Z root
  </code></pre>
  
  <p>I can use <code>tshark</code> to apply a filter to a given <code>.cap</code> file and have it output to a new <code>.cap</code> file no problem using the following command:</p>
  
  <pre><code>tshark -R &lt;FILTER&gt; -r in.cap0001 -w out.cap0001
  </code></pre>
  
  <p>Tshark main page states, </p>
  
  <blockquote>
    <p>"-r  ...It is possible to use named pipes or stdin (-)
    here..."</p>
  </blockquote>
  
  <p>but I am by no means an expert with named <code>pipes</code>, <code>stdin</code>, nor am I programmer. </p>
  
  <p>Could someone point me in the right direction? Thanks!</p>