Wireshark-dev: Re: [Wireshark-dev] tshark option for reassembled fragment output
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Evan Huus <eapache@xxxxxxxxx>
Date: Wed, 27 Mar 2013 12:17:34 -0400
On Wed, Mar 27, 2013 at 11:42 AM, Hadriel Kaplan <HKaplan@xxxxxxxxxxxxxx> wrote:
>
> On Mar 27, 2013, at 8:52 AM, Evan Huus <eapache@xxxxxxxxx> wrote:
>
>> We just got another bug on what I believe is exactly the same issue:
>>
>> https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8529
>>
>> Do we have at least a rough consensus on what the correct behaviour is?
>
> I've had a patch sitting in my harddrive for a couple weeks.  Right now it's using '-Y <display_filter>' as the option.
> I didn't submit it because I was waiting for rough consensus on the command option.

That patch is a Very Good Thing. I know we discussed a few tweaks (for
example it probably shouldn't imply -2?), but I think those and the
actual flag used are bike-shedding at this point.

I still want to pick some nits, but I'm more than happy to commit the
current patch now so that at least there's *a* way to do it, even if
it's not the best way.

> I'll try running it with the pcap attached to the bug above to see if it resolves that issue.

I strongly suspect it will if I'm understanding all the relevant
points, but verification would be nice.

Cheers,
Evan