Wireshark-bugs: [Wireshark-bugs] [Bug 3998] tshark with a read filter of smb.response_in does no
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 10 Sep 2009 13:40:47 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3998


Guy Harris <guy@xxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |guy@xxxxxxxxxxxx
             Status|NEW                         |RESOLVED
         Resolution|                            |WONTFIX




--- Comment #1 from Guy Harris <guy@xxxxxxxxxxxx>  2009-09-10 13:40:47 PDT ---
TShark is, by design and intent, a single-pass program - it moves forward
through the packets and, once it's dissected a packet, it never looks at it
again.

This makes it impossible for it to fill in the "smb.response_in" field, as you
note:

    Maybe this is an issue with all derived information where the next packet
is
needed to populate the derived information for the Request?


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.