title: Wireshark tshark -R vs -Y filter option
body: <p>tshark provides <code>-R</code> and <code>-Y</code> filters, what is the difference between read filter <code>-R</code> and display filter <code>-Y</code>. I have been using the <code>-Y</code> option to apply a filter to get a subset of the logs while converting them to pdml (xml) for further processing.</p>
  
  <pre><code>tshark -r source.pcap -Y "(s1ap.procedureCode == 13 &amp;&amp; nas_eps.nas_msg_emm_type == 0x5e )" -T pdml &gt; filtered_xml.xml
  </code></pre>
  
  <p>This works fine on windows build. However -Y is an invalid option on linux build.</p>
  
  <pre><code>mymachine{66}$ tshark -v
  TShark 1.8.10 (SVN Rev Unknown from unknown)
  </code></pre>
  
  <ul>
  <li>what is the difference between the <code>-Y</code> and <code>-R</code> filter options ?</li>
  <li>In the linux build I do not see the <code>-Y</code> option, what is the equivalent that can be used ?</li>
  </ul>
  
  <p>From <code>tshark -h</code> on windows</p>
  
  <pre><code>-R &lt;read filter&gt;         packet Read filter in Wireshark display filter syntax
  
  -Y &lt;display filter&gt;      packet displaY filter in Wireshark display filter
  </code></pre>