Wireshark · Ethereal-dev: Re: [ethereal-dev] feature request for wiretap/ethereal

[Guy Harris <guy@xxxxxxxxxx>]

> It would be nice if I could tell ethereal to write out the packet data
> through the wiretap processing routines regardless of whether I'm saving
> the data as the same type of file.

What happens if you have no display filter set, but select "Save only
packets currently being displayed"?  Currently, the save code doesn't
check whether the display filter is non-trivial before deciding to use
Wiretap to write the capture file, it does so if you've selected "Save
only packets currently being displayed" even if all the packets are
being displayed.