Christopher Maynard <Christopher.Maynard@...> writes:
> I think there is a difference between displaying the packets matching the
> filter
> and saving the packets matching the filter to another pcap file. In the former
> case, Wireshark does not display packets that don't match the display filter;
> I think tshark should behave the same way.
>
> Only when you save packets off to another pcap file do the dependencies also
> get
> saved using Wireshark. That's what I think tshark should do here as well.
And speaking of tshark behaving like Wireshark, should we dispense with the -2
option and make a two-pass analysis the default? We could add a -1 option to
make tshark behave as it does today.