Re: tshark option for reassembled fragment output

[Evan Huus <eapache () gmail com>]

On Wed, Mar 27, 2013 at 11:42 AM, Hadriel Kaplan <HKaplan () acmepacket com> wrote:
> On Mar 27, 2013, at 8:52 AM, Evan Huus <eapache () gmail com> wrote:
>
> > We just got another bug on what I believe is exactly the same issue:
> >
> > https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8529
> >
> > Do we have at least a rough consensus on what the correct behaviour is?
>
> I've had a patch sitting in my harddrive for a couple weeks.  Right now it's using '-Y <display_filter>' as the 
> option.
> I didn't submit it because I was waiting for rough consensus on the command option.

That patch is a Very Good Thing. I know we discussed a few tweaks (for
example it probably shouldn't imply -2?), but I think those and the
actual flag used are bike-shedding at this point.

I still want to pick some nits, but I'm more than happy to commit the
current patch now so that at least there's *a* way to do it, even if
it's not the best way.

> I'll try running it with the pcap attached to the bug above to see if it resolves that issue.

I strongly suspect it will if I'm understanding all the relevant
points, but verification would be nice.

Cheers,
Evan
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe