This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the meaning of two-pass analysis?

0

Hi, In Wireshark 1.8 and later version,Tshark added a option -2(perform a two-pass analysis). What is the meaning of two-pass analysis? Who can introduce it for me?

asked 25 Mar '13, 00:01

qqgeet's gravatar image

qqgeet
21226
accept rate: 0%

edited 25 Mar '13, 00:03


One Answer:

4

In a single (linear) pass through a capture file you can only carry information forwards. That is enough in most cases, but for some higher level analysis this isn't enough. Think of things like request/response tracking. In a single pass you cannot annotate a request with the frame number of the corresponding response. With two-pass analysis you can, because you note the corresponding request and response frame numbers together, and with the second pass make the annotations.

answered 25 Mar '13, 00:08

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%