Wireshark-dev: Re: [Wireshark-dev] tshark option for reassembled fragment output
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Evan Huus <eapache@xxxxxxxxx>
Date: Thu, 28 Mar 2013 10:57:25 -0400
On Wed, Mar 27, 2013 at 7:10 PM, Hadriel Kaplan <HKaplan@xxxxxxxxxxxxxx> wrote:
> [note: Interestingly in Wireshark if you either do "wireshark -r <file> -d icmp.resp_in" or set that display-filter before opening the file within the GUI, nothing shows up either at first... but if you clear the display filter inside the gui after the file is open and re-apply the filter, the correct frames show up.  But that's because of what I had said earlier: it performs a first-pass on reading the file with the read-filter and display-filter, and a second pass while loading the GUI packet-store which was filled by whatever passed the first-pass, which won't contain anything in this case because the ICMP requests won't pass this display-filter in the first pass.]

The -d -r case fixed in r48615. The case where the user manually
enters a display filter first in the GUI is a bit more complicated to
fix.