Wireshark-dev: Re: [Wireshark-dev] tshark option for reassembled fragment output
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Christopher Maynard <Christopher.Maynard@xxxxxxxxx>
Date: Mon, 4 Mar 2013 06:01:06 +0000 (UTC)
Hadriel Kaplan <HKaplan@...> writes:

> The *tshark* legacy '-R' by itself (without the '-2') is also fairly
confusing.  It doesn't behave as a
> Wireshark read filter or display filter.


No, unfortunately it behaves as both a read filter and display filter.  I think
tshark needs a display filter option, regardless of whether Evan's suggestion of
eliminating read filters is implemented or not.