filter_and_save
Filter packets from a PCAP file using a display filter and save matching packets to a new PCAP file.
Instructions
Filter packets from a PCAP file and save the result to a new PCAP file.
Args: input_file: Path to the source PCAP file output_file: Path where the filtered PCAP will be saved display_filter: Display filter to select packets (e.g. "tcp.port == 80")
Returns: Status message with packet count written
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| input_file | Yes | ||
| output_file | Yes | ||
| display_filter | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |