ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 4070] Add a facility within wireshark to remove duplicate

Date: Tue, 30 Nov 2010 08:00:32 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4070

--- Comment #9 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2010-11-30 08:00:27 PST ---
(In reply to comment #7)
> Unfortunately
> I got side tracked on other issues/problems so I never got a chance to finish
> that particular piece of code.  Perhaps it's time to dust off and cleanup that
> de-dup patch.  

Interesting idea Jim.  Do you have a duster handy? :)

> FWIW: Without the wireshark de-dup patch I have found that enabling the MD5
> hash generation, creating a "frame.md5_hash" custom column and sorting the
> trace by the MD5 hash column generally works as a quick and dirty way of
> identifying duplicates.

Good tip, although as I understand it, this will only catch exact duplicates,
i.e., frames with all data exactly the same, even timestamps, right?  As Jaap
pointed out in comment #3, if there are many duplicates due to ingress+egress,
then timestamps might differ slightly, so the md5 hashes will also be
different, even though for all practical purposes, those frames are still
really duplicates.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.