[Guy Harris <guy@xxxxxxxxxx>]

> Linux RedHat 6.2 (Linux 2.2.14-5.0smp)
> ethereal 0.9.0, with GTK+ 1.2.10, with GLib 1.2.10, with libpcap 0.4, with 
> libz 1.1.3, with UCD SNMP 4.2.3
> 
> I started a packet capture, with the filter:
> 
>          host imap.wallst.micromuse.com and tcp port 143
> 
> I then did a text print to file, and the packets that got saved in the file 
> were not identical to the ones displayed on the screen (the displayed ones 
> were correct).   I'm attaching a screen shot and the text file.  The packet 
> that differs is #76.  In the display, it is a IMAP response.  In the text 
> file, it is a duplicate of #75 (a Request).

This may be a bug in the IMAP dissector, where it interprets the packet
as an IMAP response on the first pass through the capture file (in which
the column headings are set) and as an IMAP request on subsequent passes
through the capture file (as done by, for example, a print operation).

Without a copy of the raw capture file, however, we might not be able to
figure out whether that's the problem and, if it is, what the bug is and
what the fix is.