Wireshark-bugs: [Wireshark-bugs] [Bug 9048] two pass analysis does not show any packets with som
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sun, 18 Aug 2013 19:26:51 +0000

Comment # 4 on bug 9048 from 
Wait, no, this patch breaks combining -w and -Y: if you are writing the output
to another capture (with -w) and have a display filter (with -Y) then the
behaviour with/without -2 is different:
- without -2 all frames would be written
- with -2 only frames passing -Y would be written

I think -Y should affect -w (so that you can save only requests that have a
response, for example). So maybe process_packet needs to return three-state
enum (FAILED_READ_FILTER, FAILED_DISPLAY_FILTER, PASSED_BOTH)?

Also, my previous worry about the second pass processing extra frames is wrong
- there won't be framedata for those frames, so it won't happen. I think this
makes the max_packet_count check in the second pass entirely unnecessary?

You are receiving this mail because:
  • You are watching all bug changes.