Platform :- Fedora 13 32-bit machine

RemoteMachine$ ./rpcapd -n

ClientMachine$ tshark -w "filename" -i "any interface name"

As soon as capture starts without any capture filter, thousands of packets get captured. Rpcapd binds to 2002 port by default and while establishing the connection it sends a randomly chosen port number to the client for further communication. Both client and server machines exchange tcp packets through randomly chosen ports. So, I cannot even specify the capture filter to block this rpcap related tcp traffic.

Wireshark & tshark for Windows have an option "Do not capture own Rpcap Traffic" in Remote Settings in Edit Interface Dialog box. But there is no such option in tshark for linux.

It will be also better if anyone can tell me how wireshark blocks rpcap traffic....


1 Answer 1


Use a display filter that blocks the RPCAP protocol, not the port nor IP address.

I have no data to try, but how does this work?

$ tshark -R 'not rpcap' and_then_the_rest_of_your_command
  • Can you plz tell me how to block RPCAP protocol ??? Nov 13, 2013 at 7:41
  • It's working fine to block RPCAP but RPCAP is present in those packets only which are used for initiating and closing the process. All other communication takes place over simple TCP Protocol. Dec 10, 2013 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.