Wireshark-dev: Re: [Wireshark-dev] tshark option for reassembled fragment output
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Christopher Maynard <Christopher.Maynard@xxxxxxxxx>
Date: Sun, 3 Mar 2013 19:22:11 +0000 (UTC)
Christopher Maynard <Christopher.Maynard@...> writes:

> I think there is a difference between displaying the packets matching the
> filter
> and saving the packets matching the filter to another pcap file.  In the former
> case, Wireshark does not display packets that don't match the display filter; 
> I think tshark should behave the same way.
> 
> Only when you save packets off to another pcap file do the dependencies also
> get
> saved using Wireshark.  That's what I think tshark should do here as well.

And speaking of tshark behaving like Wireshark, should we dispense with the -2
option and make a two-pass analysis the default?  We could add a -1 option to
make tshark behave as it does today.