Wireshark-bugs: [Wireshark-bugs] [Bug 7667] Option needed to save *only* displayed packets, not
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 16 May 2016 20:51:12 +0000

changed bug 7667


What Removed Added
CC   kerry.hjertaas@vecima.com

Comment # 12 on bug 7667 from 
Created attachment 14568 [details]
Capture with export and displayed not equal for filter "eth.src ==
aa:bb:cc:dd:ee:ff"

Just FYI, I came across this same behaviour, and I'm glad I found this bug
report so I could find the workaround.  Anyway, just letting you all know that
this is still an issue now almost 4 years after it was first reported.

The attached PCAP has this exact problem occurring.  When you enter the filter
"eth.src == aa:bb:cc:dd:ee:ff" it shows 841 packets, but when you select File
-> Export Specified Packets, with the options "All Packets" and "Displayed", it
exports 853 packets.  The extra 12 packets have the aa:bb:cc:dd:ee:ff as their
destination MAC.  This particular scenario is sending a UDP/RTP encapsulated
MPEG video stream into a device, which then sends it back out after some
buffering rate conversion (in this case from ~7.3 MBps to ~40 Mbps), so the two
streams are expected to be somewhat similar.

I was able to use the workaround in comment 10 to get around this for now, but
it's definitely not intuitive.

I'm seeing the problem in version 2.0.3 (v.2.0.3-0-geed34f0 from master-2.0).

You are receiving this mail because:
  • You are watching all bug changes.