Wireshark-bugs: [Wireshark-bugs] [Bug 10694] TSHARK doesn't capture the entire reassembled frame

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 12 Nov 2014 14:43:18 +0000

changed bug 10694


What Removed Added
CC   [email protected]

Comment # 2 on bug 10694 from 
As Alexis said -Y should do the trick. Per tshark manpage:
"-Y <displaY filter>

    Cause the specified filter (which uses the syntax of read/display filters,
rather than that of capture filters) to be applied before printing a decoded
form of packets or writing packets to a file. Packets matching the filter are
printed or written to file; packets that the matching packets depend upon
(e.g., fragments), are not printed but are written to file; packets not
matching the filter nor depended upon are discarded rather than being printed
or written.

    Use this instead of -R for filtering using single-pass analysis. If doing
two-pass analysis (see -2) then only packets matching the read filter (if there
is one) will be checked against this filter."

You are receiving this mail because:
  • You are watching all bug changes.