Wireshark-dev: Re: [Wireshark-dev] tshark --export-objects : -2 assumed or required for two-pas
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: John Thacker <johnthacker@xxxxxxxxx>
Date: Mon, 10 Aug 2020 21:00:13 -0400
On Mon, Aug 10, 2020 at 5:32 PM chuck c <bubbasnmp@xxxxxxxxx> wrote:
tshark --export-objects dicom is behaving differently than exporting Dicom objects in Wireshark.

Is the "-2" option assumed to be set, observed if set or not used at all for exporting objects with tshark?

Having implemented Export Objects on a different custom TFTP-like protocol, I experienced the same thing.

With tshark, -2 is observed if set, and that can result in different behavior. Generally more accurate information is obtained with two passes, which is equivalent to Wireshark behavior.

There are certain protocols where single pass analysis just isn't sufficient to determine all the data, and dissectors where some state object is set, like packet-dcm.c, are a common case.

John Thacker