Wireshark · Wireshark-dev: Re: [Wireshark-dev] tshark option for reassembled fragment output

[Christopher Maynard <Christopher.Maynard@xxxxxxxxx>]

Hadriel Kaplan <HKaplan@...> writes:

> The *tshark* legacy '-R' by itself (without the '-2') is also fairly
confusing.  It doesn't behave as a
> Wireshark read filter or display filter.


No, unfortunately it behaves as both a read filter and display filter.  I think
tshark needs a display filter option, regardless of whether Evan's suggestion of
eliminating read filters is implemented or not.