When I filter a packet capture, and then export the filtered packets, the capture numbers do not match. On the filtered display, the status bar would be x records displayed. But when I go to export specified packets, the total in displayed, all packets would be y records under displayed and with all packets selected. More often than not, x <> y.
Why does is it usually not true that x = y and how do I get the numbers to match?
This is most likely due to Wireshark saving all dependent frames along with the displayed frames. See Bug 7667.
If you don't want dependent frames to be saved, then there are a few work-arounds, as mentioned in the bug report. My suggestion in Comment 14 was to mark all displayed packets after applying the display filter, and then instead of exporting all displayed frames, export all marked frames. I believe that work-around should still work if you really don't want the dependent frames saved, but keep in mind that if you don't also export the dependent frames, then things like reassembly won't work. Generally it's a good idea to export the dependent frames unless you have a very specific reason not to.
Thank you for your answer. This worked! I have to say that I'm really impressed. Many times when questions are asked on forums like these, people just post replies without understanding the problem or objective(s).
Thank you again!
Comments