Wireshark-dev: Re: [Wireshark-dev] Splitting one packet into multiple packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 26 Feb 2011 11:03:56 -0800
On Feb 24, 2011, at 12:31 AM, Roland Knall wrote:

> I figured there are 2 ways of achieving this:
> 
> 1. Use a DisplayFilter - but so far I have not found a solution using
> this approach.

That's because no such solution exists.  All a display filter does is limit the frames that get displayed; it does not affect the way that they're displayed - in particular, it will not cause a single frame to be displayed as multiple items in the packet list.

> 2. Use some sort of CaptureFilter - which would require messing around
> with libpcap/winpcap . The solution must be cross-platform.

All a capture filter does is limit the frames that get captured; it does not affect the way they're turned into records in a pcap file, or the way that they're displayed - in particular, it will not cause a single frame to be displayed as multiple items in the packet list.