https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234
--- Comment #6 from Pete Christensen <wireshark@xxxxxxxxxxxxxxxxxxxxx> 2008-08-16 08:30:26 PDT ---
The wireshark man page reads as follows:
-R <read (display) filter>
When reading a capture file specified with the -r flag, causes the
specified filter (which uses the syntax of display filters, rather
than that of capture filters) to be applied to all packets read
from the capture file; packets not matching the filter are dis‐
carded.
The tshark man page reads as follows:
-R <read (display) filter>
Cause the specified filter (which uses the syntax of read/display
filters, rather than that of capture filters) to be applied before
printing a decoded form of packets or writing packets to a file;
packets not matching the filter are discarded rather than being
printed or written.
I think this is a tshark documentation bug. I suggest syncing the tshark and
wireshark man pages for the -R flag documentation. Probably the original
behaviour of read filters applying to captures was wrong to begin with.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.