Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 8223] tshark doesn't save all dependent frames when using a read filter (-R).

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 10 on bug 8223 from Evan Huus

This was subject to a fairly long discussion on -dev:
https://www.wireshark.org/lists/wireshark-dev/201303/msg00008.html

We seem to have reached a basic concensus at least:
- keep -2 for explicit two-pass analysis
- display filter done with -d works with both one and two-pass analysis
- read filter done with -R works as it currently does (with and without -2) but
prints a warning without -2, since you probably meant just -d instead

An open issue is that tshark already has -d. I suggested moving it to -A, but
that's already taken for rpcap on windows. Moving rpcap to -Y seems reasonable,
since it has no particular relation with either letter (whereas "decode-As"
makes some sense at least).

---

      You are receiving this mail because:

• You are watching all bug changes.