Re: tshark option for reassembled fragment output

[Christopher Maynard <Christopher.Maynard () gtech com>]

Christopher Maynard <Christopher.Maynard@...> writes:

> I think there is a difference between displaying the packets matching the
> filter
> and saving the packets matching the filter to another pcap file.  In the former
> case, Wireshark does not display packets that don't match the display filter; 
> I think tshark should behave the same way.
>
> Only when you save packets off to another pcap file do the dependencies also
> get
> saved using Wireshark.  That's what I think tshark should do here as well.

And speaking of tshark behaving like Wireshark, should we dispense with the -2
option and make a two-pass analysis the default?  We could add a -1 option to
make tshark behave as it does today.


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe