Wireshark-bugs: [Wireshark-bugs] [Bug 7667] Export Specified Packets not recognizing the "eth.sr
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7667
--- Comment #7 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2012-08-29 08:07:53 PDT ---
(In reply to comment #5)
> That is exactly what is happening. The duplicated packets are being included in
> the Reassembled MP2T Packet at the end of a video frame in the PES.
>
> So is there a way to not save the dependencies? Would it be possible to add
> another option in the "Packet Range" group of the Export Specified Packet file
> dialog that would say something like "All packets ( + dependencies)" , then the
> "All Packets" option would just be the displayed ones without dependencies?
Yes, I had even considered making it an option at the time I just couldn't find
a use case where it would be useful to not include dependencies. Looks like
you provided that...
Another possibility would be to fix the reassembly stuff (or Wireshark in
general) to better detect the duplicates and effectively ignore them (at least
in, for example, TCP and higher); I think there is(are) also bug report(s)
asking for that. That would probably be a bunch more work though.
(In reply to comment #6)
> (In reply to comment #5)
> > So is there a way to not save the dependencies?
>
> AFAIK tshark doesn't support dependencies, so something like this should work:
>
> tshark -r capture_file -w new_capture_file -R 'eth.src !=
> 00:10:27:00:54:5c'
Yes, that would work since tshark (normally) makes only one pass through the
file; unfortunately I discovered a while back that enabling 2-pass mode did not
make the frame dependency stuff work (forget why; core dump?).
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
