On Wed, Mar 27, 2013 at 2:27 PM, Christopher Maynard <christopher.mayn...@gtech.com> wrote: > Evan Huus <eapache@...> writes: > >> Tshark's current -d is moved to -A (for "decode As") to make room for >> the new -d (which is then consistent with wireshark's -d). > > Wireshark's -A is for RPCAP password authentication. Should we reserve -A for > that? (I assume it would be possible to support this with tshark.)
Yuck, I didn't see that since it's windows-only. Perhaps rpcap auth could simply get moved to Y (which would be free in both tshark and wireshark)? It doesn't seem to have a useful association with either letter. On Wed, Mar 27, 2013 at 2:43 PM, Hadriel Kaplan <hkap...@acmepacket.com> wrote: > > On Mar 27, 2013, at 1:57 PM, Evan Huus <eapa...@gmail.com> wrote: > >> -d filtering is done when displaying, and has no effect on the >> internal dissection at all (note this does not force 2 passes). > > Actually I'm pretty sure Wireshark *does* perform two passes when a display > filter is applied from the command line. It performs the first-pass on > reading the file during which it applies a read-filter if supplied as well as > a display-filter if supplied, and it does a second display-filter and > dissection pass during loading of the GUI's packet-store (which was filled by > whatever passed the first pass). I think this is just a potential optimization in Wireshark, not required behaviour. It shouldn't (?) materially affect my proposal. Evan ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
