Very strange thing happening with Wireshark 1.10.7. If you toggle the time reference for any packet (doesn't even have to be an RTP packet), and then apply the "rtp.marker==1" display filter, that packet will be displayed when it should not be. Can anyone else confirm this is happening? Is this a bug or am I doing something wrong here? Thanks. Travis asked 29 May '14, 18:19  Rooster_50 edited 29 May '14, 18:20 |
One Answer:
No, you're not doing anything wrong. Some testing shows that packets with a Time Reference set are always displayed, regardless of what display filter is applied, even when the display filter is "!(frame.ref_time)" which should explicitly exclude all packets that have a Time Reference set. Update: I have reported this as a bug on the Wireshark Bugzilla. Bug 10142. answered 29 May '14, 19:29  Jim Aragon edited 29 May '14, 21:52 |
Thanks Jim. Would you mind posting the bug number? I would be interested in following it. Thanks again.
Travis
Not sure this is a bug at all - it is often quite useful to see time reference points even when the packet would have been normally hidden by a filter. So this may be intentional.