On Mon, Aug 10, 2020 at 5:32 PM chuck c <bubbas...@gmail.com> wrote: > tshark --export-objects dicom is behaving differently than exporting > Dicom objects in Wireshark. > > Is the "-2" option assumed to be set, observed if set or not used at all > for exporting objects with tshark? >
Having implemented Export Objects on a different custom TFTP-like protocol, I experienced the same thing. With tshark, -2 is observed if set, and that can result in different behavior. Generally more accurate information is obtained with two passes, which is equivalent to Wireshark behavior. There are certain protocols where single pass analysis just isn't sufficient to determine all the data, and dissectors where some state object is set, like packet-dcm.c, are a common case. John Thacker
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
