Wireshark-bugs: [Wireshark-bugs] [Bug 9048] two pass analysis does not show any packets with som
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 22 Aug 2013 02:11:33 +0000

Comment # 8 on bug 9048 from 
(In reply to comment #7)
> (In reply to comment #4)
> > Wait, no, this patch breaks combining -w and -Y: if you are writing the
> > output to another capture (with -w) and have a display filter (with -Y) then
> > the behaviour with/without -2 is different:
> > - without -2 all frames would be written
> > - with -2 only frames passing -Y would be written
> > 
> > I think -Y should affect -w (so that you can save only requests that have a
> > response, for example). So maybe process_packet needs to return three-state
> > enum (FAILED_READ_FILTER, FAILED_DISPLAY_FILTER, PASSED_BOTH)?
> 
> I'd rather save all frames, like wireshark 'File -> Save as' does.

I disagree. I think -Y is simplest to understand if it affects any output
equally. The case of simultaneously capturing to a file *and* printing is
unusual, and wanting to filter one but not the other is even more unusual.

You are receiving this mail because:
  • You are watching all bug changes.