Wireshark · Ethereal-dev: Re: [Ethereal-dev] Note on r16258 / Bug 537

[Ulf Lamping <ulf.lamping@xxxxxx>]

Jaap Keuter wrote:

> Hi list,
>
> Since it seems worthwhile to include a bugfix on a call to
> fragment_add_check() in 0.10.13, it may be considered to repair the
> documentation on this part as well. I've done so in a patch to the EDG
> send in on Oct 13th. It has not been accepted/rejected so far.
>  
checked in

> On another note I proposed a patch to the editcap man page. Ulf suggested
> a more informative statement about packet ranges. I've included that in
> the synopsys as well as presented some examples. Please provide feedback
> with better real-life examples so I can use them.
>  
Your second approach looks good to me, some questions (I'm using editcap 
often):

      To delete packet 1000 from the capture file use:

          editcap capture.pcap sans1000.pcap 1000

Well, you might replace "sans1000.pcap" by "without1000.pcap".

Is this really this way? I would expect that only packet 1000 is in the 
capture file then.

      To cut off a capture file at packet 500 use:

          editcap capture.pcap 500.pcap 501-

          or

          editcap -r capture.pcap 500.pcap -500

Sounds unlogical. I would expect 501- would cut off packets 1-500, and 
-500 to cut off everything after 500

Isn't it possible to add ranges like: 10-20,30-40?

Regards, ULFL