Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 6681] -R misfeatures with -w and -c

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6681

--- Comment #2 from Sake <sake@xxxxxxxxxx> 2011-12-21 01:37:30 PST ---
(In reply to comment #1)
> The -c <packet count> option is used as a capture stop condition, not a display
> stop condition, so that is the expected behavior.

Actually, the "-c <n>" option with tshark is intended to stop after
*displaying* <n> packets and works as intended in trunk:

sake@macsake-wifi:~/Wireshark/pcap$ tshark -r http.cap -c 10
  1   0.000000 192.168.1.43 -> 66.102.13.103 TCP 50166 > http [SYN] Seq=0
Win=65535 Len=0 MSS=1460 WS=8 TSval=783926564 TSecr=0 SACK_PERM=1
  2   0.056384 66.102.13.103 -> 192.168.1.43 TCP http > 50166 [SYN, ACK] Seq=0
Ack=1 Win=5672 Len=0 MSS=1430 SACK_PERM=1 TSval=56870209 TSecr=783926564 WS=64
  3   0.056453 192.168.1.43 -> 66.102.13.103 TCP 50166 > http [ACK] Seq=1 Ack=1
Win=524280 Len=0 TSval=783926564 TSecr=56870209
  4   0.056589 192.168.1.43 -> 66.102.13.103 HTTP GET / HTTP/1.1 
  5   0.083797 66.102.13.103 -> 192.168.1.43 TCP http > 50166 [ACK] Seq=1
Ack=650 Win=6976 Len=0 TSval=56870236 TSecr=783926564
  6   0.122335 66.102.13.103 -> 192.168.1.43 TCP [TCP segment of a reassembled
PDU]
  7   0.122406 192.168.1.43 -> 66.102.13.103 TCP 50166 > http [ACK] Seq=650
Ack=1213 Win=523448 Len=0 TSval=783926565 TSecr=56870273
  8   0.124105 66.102.13.103 -> 192.168.1.43 TCP [TCP segment of a reassembled
PDU]
  9   0.126890 66.102.13.103 -> 192.168.1.43 TCP [TCP segment of a reassembled
PDU]
 10   0.126915 192.168.1.43 -> 66.102.13.103 TCP 50166 > http [ACK] Seq=650
Ack=4049 Win=523240 Len=0 TSval=783926565 TSecr=56870273
sake@macsake-wifi:~/Wireshark/pcap$ tshark -r http.cap -c 10 -R http.request
  4   0.056589 192.168.1.43 -> 66.102.13.103 HTTP GET / HTTP/1.1 
 18   0.310148 192.168.1.43 -> 66.102.13.101 HTTP GET /generate_204 HTTP/1.1 
 22   0.350854 192.168.1.43 -> 66.102.13.103 HTTP GET
/csi?v=3&s=webhp&action=&e=17259,25279,25788&ei=MLJjTPu3AoH2-Abh2Z3vDQ&expi=17259,25279,25788&imc=1&imn=1&imp=0&rt=prt.18,xjsls.43,xjses.93,xjsee.105,xjs.115,ol.202,iml.18
HTTP/1.1 
 25   3.549680 192.168.1.43 -> 66.102.13.101 HTTP GET
/complete/search?hl=nl&client=hp&expIds=17259,25279,25788&q=p&cp=1 HTTP/1.1 
 28   3.706656 192.168.1.43 -> 66.102.13.101 HTTP GET
/complete/search?hl=nl&client=hp&expIds=17259,25279,25788&q=pi&cp=2 HTTP/1.1 
 31   3.866205 192.168.1.43 -> 66.102.13.101 HTTP GET
/complete/search?hl=nl&client=hp&expIds=17259,25279,25788&q=pie&cp=3 HTTP/1.1 
 34   4.016978 192.168.1.43 -> 66.102.13.101 HTTP GET
/complete/search?hl=nl&client=hp&expIds=17259,25279,25788&q=piet&cp=4 HTTP/1.1 
 37   4.165453 192.168.1.43 -> 66.102.13.101 HTTP GET
/complete/search?hl=nl&client=hp&expIds=17259,25279,25788&q=pietje&cp=6
HTTP/1.1 
 40   4.466591 192.168.1.43 -> 66.102.13.101 HTTP GET
/complete/search?hl=nl&client=hp&expIds=17259,25279,25788&q=pietje%20&cp=7
HTTP/1.1 
 43   4.768852 192.168.1.43 -> 66.102.13.101 HTTP GET
/complete/search?hl=nl&client=hp&expIds=17259,25279,25788&q=pietje%20p&cp=8
HTTP/1.1 
sake@macsake-wifi:~/Wireshark/pcap$ 

So if it does not work like this in any official release, that should be
considered a bug. Please reopen this bug-report if you encounter this issue and
provide the output of "tshark -v" as well as similar output as my outpout
above.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.