| Bug ID |
9048
|
| Summary |
two pass analysis does not show any packets with some combinations -c and -Y
|
| Classification |
Unclassified
|
| Product |
Wireshark
|
| Version |
SVN
|
| Hardware |
x86
|
| OS |
All
|
| Status |
UNCONFIRMED
|
| Severity |
Major
|
| Priority |
Low
|
| Component |
TShark
|
| Assignee |
[email protected]
|
| Reporter |
[email protected]
|
Build Information:
TShark 1.10.2 (SVN Rev 51377 from /trunk-1.10)
Copyright 1998-2013 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.28.6, with libpcap, with libz 1.2.3.4, with POSIX
capabilities (Linux), without libnl, with SMI 0.4.8, with c-ares 1.7.3, with
Lua
5.1, without Python, with GnuTLS 2.8.6, with Gcrypt 1.4.6, with MIT Kerberos,
with GeoIP.
Running on Linux 2.6.38-16-generic, with locale en_US.UTF-8, with libpcap
version 1.1.1, with libz 1.2.3.4.
Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz
Built using gcc 4.5.2.
--
Adding -2 to tshark with -c and -Y may not produce the same result.
Example without -2
joe@cooley:~/lab2/wireshark-1.10-trunk$ ./tshark -r dns.cap -c 1 -Y
"frame.number>1"
2 0.000269 172.16.1.1 -> 172.16.1.198 DNS 84 Standard query response
0xc576 A 10.0.0.101
However, once I switch this to a two pass using "-2", I don't see any packets
displayed.
joe@cooley:~/lab2/wireshark-1.10-trunk$ ./tshark -r dns.cap -2 -c 1 -Y
"frame.number>1"
joe@cooley:~/lab2/wireshark-1.10-trunk$
http://ask.wireshark.org/questions/23804/understanding-two-pass-analysis-with-tshark
You are receiving this mail because:
- You are watching all bug changes.