Wireshark mailing list archives
Re: tshark option for reassembled fragment output
From: Hadriel Kaplan <HKaplan () acmepacket com>
Date: Wed, 27 Mar 2013 18:43:51 +0000
On Mar 27, 2013, at 1:57 PM, Evan Huus <eapache () gmail com> wrote:
-d filtering is done when displaying, and has no effect on the internal dissection at all (note this does not force 2 passes).
Actually I'm pretty sure Wireshark *does* perform two passes when a display filter is applied from the command line. It performs the first-pass on reading the file during which it applies a read-filter if supplied as well as a display-filter if supplied, and it does a second display-filter and dissection pass during loading of the GUI's packet-store (which was filled by whatever passed the first pass). -hadriel ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Re: tshark option for reassembled fragment output, (continued)
- Re: tshark option for reassembled fragment output Hadriel Kaplan (Mar 27)
- Re: tshark option for reassembled fragment output Evan Huus (Mar 27)
- Re: tshark option for reassembled fragment output Hadriel Kaplan (Mar 27)
- Re: tshark option for reassembled fragment output Evan Huus (Mar 28)
- Re: tshark option for reassembled fragment output Hadriel Kaplan (Mar 28)
- Re: tshark option for reassembled fragment output Evan Huus (Mar 28)
- Re: tshark option for reassembled fragment output Hadriel Kaplan (Mar 28)
- Re: tshark option for reassembled fragment output Evan Huus (Mar 29)
- Re: tshark option for reassembled fragment output Hadriel Kaplan (Mar 29)
- Re: tshark option for reassembled fragment output Evan Huus (Mar 28)
- Re: tshark option for reassembled fragment output Hadriel Kaplan (Mar 27)