forked from osmocom/wireshark
Fix Bug 9938 'tshark "-Y -2 -w" saves non-dependent frames'
When the '-Y' display filter option is given with a '-2', and a '-w' to write out the packets, tshark grabs *all* dependent frames in the catprue file, even those that weren't dependents of a matching packet. Note that this also uses the '-2' two-pass option, since only two-pass mode writes out dependent frames to begin with. Change-Id: I17726447bec434ba2566e98fb78893d1331e3056 Reviewed-on: https://code.wireshark.org/review/866 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Reviewed-by: Evan Huus <eapache@gmail.com>
This commit is contained in:
parent
5cdf04e6c7
commit
b63b503456
13
tshark.c
13
tshark.c
|
@ -2904,6 +2904,9 @@ process_packet_first_pass(capture_file *cf, epan_dissect_t *edt,
|
||||||
if (cf->rfcode)
|
if (cf->rfcode)
|
||||||
epan_dissect_prime_dfilter(edt, cf->rfcode);
|
epan_dissect_prime_dfilter(edt, cf->rfcode);
|
||||||
|
|
||||||
|
if (cf->dfcode)
|
||||||
|
epan_dissect_prime_dfilter(edt, cf->dfcode);
|
||||||
|
|
||||||
frame_data_set_before_dissect(&fdlocal, &cf->elapsed_time,
|
frame_data_set_before_dissect(&fdlocal, &cf->elapsed_time,
|
||||||
&ref, prev_dis);
|
&ref, prev_dis);
|
||||||
if (ref == &fdlocal) {
|
if (ref == &fdlocal) {
|
||||||
|
@ -2925,9 +2928,13 @@ process_packet_first_pass(capture_file *cf, epan_dissect_t *edt,
|
||||||
/* If we're not doing dissection then there won't be any dependent frames.
|
/* If we're not doing dissection then there won't be any dependent frames.
|
||||||
* More importantly, edt.pi.dependent_frames won't be initialized because
|
* More importantly, edt.pi.dependent_frames won't be initialized because
|
||||||
* epan hasn't been initialized.
|
* epan hasn't been initialized.
|
||||||
|
* if we *are* doing dissection, then mark the dependent frames, but only
|
||||||
|
* if a display filter was given and it matches this packet.
|
||||||
*/
|
*/
|
||||||
if (edt) {
|
if (edt && cf->dfcode) {
|
||||||
g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->frames);
|
if (dfilter_apply_edt(cf->dfcode, edt)) {
|
||||||
|
g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->frames);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
cf->count++;
|
cf->count++;
|
||||||
|
@ -3172,7 +3179,7 @@ load_cap_file(capture_file *cf, char *save_file, int out_file_type,
|
||||||
|
|
||||||
/* If we're going to be applying a filter, we'll need to
|
/* If we're going to be applying a filter, we'll need to
|
||||||
create a protocol tree against which to apply the filter. */
|
create a protocol tree against which to apply the filter. */
|
||||||
if (cf->rfcode)
|
if (cf->rfcode || cf->dfcode)
|
||||||
create_proto_tree = TRUE;
|
create_proto_tree = TRUE;
|
||||||
|
|
||||||
/* We're not going to display the protocol tree on this pass,
|
/* We're not going to display the protocol tree on this pass,
|
||||||
|
|
Loading…
Reference in New Issue