https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14266
--- Comment #24 from Guy Harris <[email protected]> ---
(In reply to zpchi004 from comment #23)
> After running: tshark -V -r {file starting w/ the beamformed packet}
>
> a) b) c) d) are all correct:
>
> a) Radiotap header v0 -> VHT info -> TXOP_PS_NOT_ALLOWED: True
> b) Radiotap header v0 -> VHT info -> Beamformed: True
> c) 802.11 radio info -> TXOP_PS_NOT_ALLOWED: True
> d) 802.11 radio info -> Beamformed: True
>
> After running: tshark -V -2 -r {file starting w/ the beamformed packet}
>
> a) b) are correct. c) d) are wrong:
>
> a) Radiotap header v0 -> VHT info -> TXOP_PS_NOT_ALLOWED: True
> b) Radiotap header v0 -> VHT info -> Beamformed: True
> c) 802.11 radio info -> TXOP_PS_NOT_ALLOWED: False
> d) 802.11 radio info -> Beamformed: False
Exactly as I suspected.
> I'd appreciate if you can briefly explain what is the difference between the
> above two cmds. What does "-2" mean? Thanks.
The TShark man page at:
https://www.wireshark.org/docs/man-pages/tshark.html
says:
−2 Perform a two‐pass analysis. This causes tshark to buffer output
until the entire first pass is done, but allows it to fill in
fields that require future knowledge, such as ’response in frame #’
fields. Also permits reassembly frame dependencies to be calculated
correctly.
By default, TShark reads each packet from the capture file, in order, dissects
it, and prints the result of the dissection (-V means "print the details rather
than the one-line summary). The offending packet would be read first, before
reading any of the other packets, so there's no way that the subsequent packets
could affect how it's dissected.
-2 means that it reads all the packets, dissects them - possibly without
generating a protocol tree, so it would dissect only enough to construct any
state needed - without printing anything, and then goes back and reads all the
packets again, dissecting and printing the result of the dissection, using
whatever state was built during the first path. The second time it dissects
the offending packet, all the other packets will have been dissected, and
*some* result of that could affect the second dissection.
Wireshark reads all the packets before displaying them; that pass is analogous
to the first path of "tshark -2". If you click on a packet, it re-dissects it
to generate the protocol tree to display.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:[email protected]?subject=unsubscribe
