[bugzilla-daemon@xxxxxxxxxxxxx]

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1564

           Summary: PSML - structure context node missing
           Product: Wireshark
           Version: 0.99.5
          Platform: All
               URL: http://www.networksecuritytoolkit.org
        OS/Version: All
            Status: NEW
          Severity: Minor
          Priority: Low
         Component: TShark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: rwhalb@xxxxxxxxxxxx


Build Information:
[root@probe-biostar wireshark]# tshark -v
TShark 0.99.5

Copyright 1998-2007 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.10.3, with libpcap 0.9.4, with libz 1.2.3, with libpcre
6.3, with Net-SNMP 5.3, with ADNS, without Lua, with GnuTLS 1.2.10, with Gcrypt
1.2.2, with MIT Kerberos.

Running on Linux 2.6.18-1.2257.fc5smp, with libpcap version 0.9.4.

Built using gcc 4.1.1 20070105 (Red Hat 4.1.1-51).

--
When generating PSML output the "structure" context node is missing if a
display filter is used that causes the 1st packet in the capture not to be
displayed:

Example 1: (PSML with "structure" context node) display filter allows the first
packet to be displayed:

tshark -T psml -R 'frame.number >= 1 && frame.number <= 2' -r /tmp/capture.cap;

−<psml version="0" creator="wireshark/0.99.5">
 −<structure>
    <section>No.</section>
    <section>Time</section>
    <section>Source</section>
    <section>Destination</section>
    <section>Protocol</section>
    <section>Info</section>
  </structure>
 −<packet>
    <section>1</section>
    <section>0.000000</section>
    <section>Cisco_53:3c:01</section>
    <section>Broadcast</section>
    <section>ARP</section>
    <section>Who has 72.226.67.93?  Tell 72.226.64.1</section>
  </packet>
 −<packet>
    <section>2</section>
    <section>0.083947</section>
    <section>Cisco_53:3c:01</section>
    <section>Broadcast</section>
    <section>ARP</section>
    <section>Who has 72.226.64.232?  Tell 72.226.64.1</section>
  </packet>
</psml>


Example 2: (PSML without "structure" context node) display filter does not
allow the first packet to be displayed:

tshark -T psml -R 'frame.number >= 2 && frame.number <= 2' -r /tmp/capture.cap;

−<psml version="0" creator="wireshark/0.99.5">
 −<packet>
    <section>2</section>
    <section>0.083947</section>
    <section>Cisco_53:3c:01</section>
    <section>Broadcast</section>
    <section>ARP</section>
    <section>Who has 72.226.64.232?  Tell 72.226.64.1</section>
  </packet>
</psml>


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.