https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7667
Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jeff.morriss.ws@xxxxxxxxx
--- Comment #4 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2012-08-28 14:15:37 PDT ---
(In reply to comment #3)
> (In reply to comment #2)
>
> > Can this be caused by r41216?
> >
> > Btw. It'd be great if you could attach sample capture file.
>
> I don't think r41216 is the issue.
(I think) Jakub's point is that it's possible that Wireshark thinks that the
frames that are being saved (but which you say shouldn't be) are "dependent" on
the frames that are being displayed; this marking of dependencies is the
feature that r41216 introduced. This would be the case if Wireshark is (trying
to) use both copies of the frame in the reassembly of a TCP PDU, for example.
Questions: when you reproduce the problem:
- What are the "captured" and "displayed" counts in the bottom of the main
Wireshark window?
- What are the "captured" and "displayed" counts in the "Export Specified
Packets" window?
Side note: I had modified the GUI at one point to show the dependencies in the
(at the time) Save-As dialog but at the time I couldn't get it to work well in
Windows and I didn't know if it was a good idea[1]; maybe this bug indicates
that it is.
[1] https://www.wireshark.org/lists/wireshark-dev/201202/msg00213.html
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.