Would it make sense to add BPF filtering to Wiretap via pcap_offline_filter()? This would let you pre-filter capture files in Wireshark and TShark (and possibly editcap) without having to build a protocol tree. The main disadvantage is that it's only available in WinPcap. _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
- [Wireshark-dev] Add BPF filtering to Wiretap? Gerald Combs
