diff --git a/doc/release-notes.adoc b/doc/release-notes.adoc index 16aa24cbe0..d5f0bba4fd 100644 --- a/doc/release-notes.adoc +++ b/doc/release-notes.adoc @@ -122,6 +122,13 @@ The following features are new (or have been significantly updated) since versio * Truncated fields in the detail view are now displayed as "Field name […]: data" instead of "Field name [truncated]: data" +* When capturing files in multiple file mode, a pattern that places the date and time + before the index number can be used (e.g., foo_20240714110102_00001.pcap instead of + foo_00001_20240714110102.pcap). This causes filenames to sort in chronological order + across file sets from different captures. The File Set dialog has been updated to + handle the new pattern, which has been capable of being produced by tshark since + version 3.6.0 + === Removed Features and Support * The tshark `-G` option with no argument is deprecated and will be removed in diff --git a/docbook/wsug_src/wsug_io.adoc b/docbook/wsug_src/wsug_io.adoc index df8fced7c1..5e3fe1dd98 100644 --- a/docbook/wsug_src/wsug_io.adoc +++ b/docbook/wsug_src/wsug_io.adoc @@ -703,10 +703,13 @@ some features to handle these file sets in a convenient way. .How does Wireshark detect the files of a file set? **** -A filename in a file set uses the format Prefix_Number_DateTimeSuffix which -might look something like `test_00001_20240714183910.pcap`. All files of a file +A filename in a file set uses the format Prefix_Number_DateTimeSuffix (or, +in Wireshark 4.4.0 and later, Prefix_DateTime_NumberSuffix) which might +look something like `test_00001_20240714183910.pcap`. All files of a file set share the same prefix (e.g., “test”) and suffix (e.g., “.pcap”) and a -varying middle part. +varying middle part. Files are also allowed to have a second compression +suffix of types that Wireshark can open; the compression suffix does not +have to match for all files in a set. To find the files of a file set, Wireshark scans the directory where the currently loaded file resides and checks for files matching the filename pattern diff --git a/fileset.c b/fileset.c index f137de3b73..593d7d9f8a 100644 --- a/fileset.c +++ b/fileset.c @@ -23,6 +23,8 @@ #include #include +#include + #include #include "fileset.h" @@ -58,104 +60,141 @@ static fileset set = { NULL, NULL}; #endif /* _WIN32 */ /* is this a probable file of a file set (does the naming pattern match)? */ -gboolean -fileset_filename_match_pattern(const char *fname) +fileset_match_t +fileset_filename_match_pattern(const char *fname, char **prefix, char **suffix, char **time) { - char *pfx; - size_t baselen; - size_t minlen = strlen("_00001_20050418010750"); + char *sfx; char *filename; + fileset_match_t ret = FILESET_NO_MATCH; + static char *pattern = "(?P.*)_\\d{5}_(?P