|
Hi, In Wireshark 1.8 and later version,Tshark added a option -2(perform a two-pass analysis). What is the meaning of two-pass analysis? Who can introduce it for me? |
|
In a single (linear) pass through a capture file you can only carry information forwards. That is enough in most cases, but for some higher level analysis this isn't enough. Think of things like request/response tracking. In a single pass you cannot annotate a request with the frame number of the corresponding response. With two-pass analysis you can, because you note the corresponding request and response frame numbers together, and with the second pass make the annotations. |
