Wireshark-bugs: [Wireshark-bugs] [Bug 5240] Patch to editcap to allow chop from beginning of pac
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5240
--- Comment #8 from Jason Masker <jason@xxxxxxxxxx> 2010-09-22 11:16:59 PDT ---
(In reply to comment #7)
> I never figured out in which cases to chop of a fixed amount of bytes of the
> end of the packet, but I do understand the usefulness of chopping of an amount
> of bytes from the beginning.
>
> Would it be an idea to use -C for both and change it's behavior to do the
> following:
>
> - a positive value will chop off that amount of bytes from the beginning of the
> packet
> - a negative value will chop off the (absolute) amount of bytes from the end of
> the packet
>
> That would change the behavior of the current implementation of -C, but it will
> adhere more to general use of negative and positive values when it comes to
> chopping. And I doubt if the feature is used much in its current form.
If we did that would we allow -C to be passed exactly 0, 1 or 2 times
allowing at most 1 negative and 1 positive value to be passed? Using
-C would also solve the problem of there being no really good letters
left to choose for this, thus the choice of -P, but I'm just wondering
how best to handle the case where we want to do both a -P and -C
(again I struggle to think of a practical use for this). I suppose
worse case, we could allow -C once and a user could run a file through
editcap twice to achieve a chop to both the beginning and end of a
packet.
-Jason
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
