https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7667
--- Comment #5 from Joe Lemanski <joe.lemanski@xxxxxxxxxx> 2012-08-29 06:55:02 PDT ---
> (I think) Jakub's point is that it's possible that Wireshark thinks that the
> frames that are being saved (but which you say shouldn't be) are "dependent" on
> the frames that are being displayed; this marking of dependencies is the
> feature that r41216 introduced. This would be the case if Wireshark is (trying
> to) use both copies of the frame in the reassembly of a TCP PDU, for example.
>
> Questions: when you reproduce the problem:
> - What are the "captured" and "displayed" counts in the bottom of the main
> Wireshark window?
> - What are the "captured" and "displayed" counts in the "Export Specified
> Packets" window?
>
> Side note: I had modified the GUI at one point to show the dependencies in the
> (at the time) Save-As dialog but at the time I couldn't get it to work well in
> Windows and I didn't know if it was a good idea[1]; maybe this bug indicates
> that it is.
>
> [1] https://www.wireshark.org/lists/wireshark-dev/201202/msg00213.html
That is exactly what is happening. The duplicated packets are being included in
the Reassembled MP2T Packet at the end of a video frame in the PES.
So is there a way to not save the dependencies? Would it be possible to add
another option in the "Packet Range" group of the Export Specified Packet file
dialog that would say something like "All packets ( + dependencies)" , then the
"All Packets" option would just be the displayed ones without dependencies?
I know this situation is rare, and I really like the new functionality of the
MP2T dissector, but in my line of work this is something that comes up. I think
there should probably be an options to include or not include the dependencies,
and maybe a tool tip if possible that describes the difference. That way others
won't be confused like it was as to what is happening.
I appreciate your help with this!
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.