thx again for reply Guy, >You can, of course, just run with "-o tcp.desegment_tcp_streams:false" >to disable TCP reassembly entirely....
tshark -ta -ni eth0 -o tcp.desegment_tcp_streams:false and tshark use more than 500Mo! if I reenable tcp.desegment_tcp_streams and tshark use only 220Mo, why ? Regards Rmkml _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev
