Wireshark-bugs: [Wireshark-bugs] [Bug 9992] Using tshark with -w option together with -2 and -R
Date: Tue, 15 Apr 2014 04:40:35 +0000

Comment # 2 on bug 9992 from
Sorry for the messy format of this bug report.

I came across this while checking out the correction to this bug:


When tested out the development release, I was not able to run tshark like I
used to run it:

C:\Program Files\Wireshark>tshark -r input.pcap -2 -R "sip or megaco" -w C:

That command results in a crash/popup - "Tshark has stopped working".

If I run the command without -2 and with Y instead of -R, the command runs OK
and the timestamps in the output look great... but the 2-pass filtering seems
broken. I tried out other display filters just in case, all with the same



You are receiving this mail because:
  • You are watching all bug changes.