Re: tshark option for reassembled fragment output

[Christopher Maynard <Christopher.Maynard () gtech com>]

Hadriel Kaplan <HKaplan@...> writes:

> The *tshark* legacy '-R' by itself (without the '-2') is also fairly
confusing.  It doesn't behave as a
> Wireshark read filter or display filter.


No, unfortunately it behaves as both a read filter and display filter.  I think
tshark needs a display filter option, regardless of whether Evan's suggestion of
eliminating read filters is implemented or not.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe