I never use tshark to capture... I use tcpdump -s0 -x port 5090 -w file.pcap

/b

On May 18, 2009, at 7:39 PM, dujinfang wrote:

I believe. 

capturing on tshark -i eth1 -w register.pcap udp port 5090

do you have further suggestions on the tshark filter?

Thanks.

-- Meet us at ClueCon!  http://www.cluecon.com