This is our old Q&A Site. Please post any new questions and answers at

Hi, In Wireshark 1.8 and later version,Tshark added a option -2(perform a two-pass analysis). What is the meaning of two-pass analysis? Who can introduce it for me?

asked 25 Mar '13, 00:01

qqgeet's gravatar image

accept rate: 0%

edited 25 Mar '13, 00:03

In a single (linear) pass through a capture file you can only carry information forwards. That is enough in most cases, but for some higher level analysis this isn't enough. Think of things like request/response tracking. In a single pass you cannot annotate a request with the frame number of the corresponding response. With two-pass analysis you can, because you note the corresponding request and response frame numbers together, and with the second pass make the annotations.

permanent link

answered 25 Mar '13, 00:08

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 25 Mar '13, 00:01

question was seen: 6,528 times

last updated: 25 Mar '13, 00:08

p​o​w​e​r​e​d by O​S​Q​A