Wireshark-bugs: [Wireshark-bugs] [Bug 8223] tshark display filter (-R) work on segments
Comment # 2
on bug 8223
from Chris Maynard
Wireshark's behavior stems from changes made to resolve bug 3315 and bug 7270.
To quote Jeff[1], "Wireshark now (in 1.7.2 and later) saves not only the
displayed packets but also the packets that are necessary to dissect those
packets (the dependencies)."
I don't think those changes are applicable to tshark though. I thought
possibly it would work if you ran tshark with the "-2" option, but when I
tested that with 1.9.0 (SVN Rev 47120), tshark crashed on me, so I don't know
for certain if it would work or not. I suspect not though. (I'll open a
separate bug for the tshark crash.)
Another bug I discovered in Wireshark while testing this is that if you open
the tesetcapture.pcapng file attached to this bug report, apply the specified
filter then choose "File -> Export Specified Packets", but instead of manually
typing the entire file name for the exported packets you first select with the
mouse the same file as what's currently open (testcapture.pcapng in this case),
modify that filename, e.g., "testcapture_bug8223_export.pcapng", and finally
click save, Wireshark pops up an error dialog incorrectly indicating,
"testcapture.pcapng identical to the loaded file. Please choose a different
filename." OTOH, if you don't initially select the current file with the mouse
and type the entire file name, then Wireshark saves the new file just fine.
(I'll open another bug for this problem.)
[1]: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7270#c2
You are receiving this mail because:
- You are watching all bug changes.
