Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 2234] Filtering tshark captures with display filters (-R) no longer works

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234





--- Comment #6 from Pete Christensen <wireshark@xxxxxxxxxxxxxxxxxxxxx>  2008-08-16 08:30:26 PDT ---
The wireshark man page reads as follows:

-R  <read (display) filter>
           When reading a capture file specified with the -r flag, causes the
           specified filter (which uses the syntax of display filters, rather
           than that of capture filters) to be applied to all packets read
           from the capture file; packets not matching the filter are dis‐
           carded.


The tshark man page reads as follows:

-R  <read (display) filter>
           Cause the specified filter (which uses the syntax of read/display
           filters, rather than that of capture filters) to be applied before
           printing a decoded form of packets or writing packets to a file;
           packets not matching the filter are discarded rather than being
           printed or written.


I think this is a tshark documentation bug. I suggest syncing the tshark and
wireshark man pages for the -R flag documentation. Probably the original
behaviour of read filters applying to captures was wrong to begin with.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.