From Hadriel Kaplan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223

Add a 2-pass display-filter flag to tshark so that reassembly and other forward-
looking dissections can be used with filters.

It's a bit of a hack, but this entire area of 2-pass analysis etc. is a giant
pile of hacks to begin with and needs cleaning up. For now just having this
feature is a big enough win.

svn path=/trunk/; revision=48589

1 files changed, 23 insertions, 2 deletions

diff --git a/doc/tshark.pod b/doc/tshark.pod
index 1a8c1c1036..8d30b0446a 100644
--- a/doc/tshark.pod
+++ b/doc/tshark.pod
@@ -35,7 +35,8 @@ S<[ B<-P> ]>
 S<[ B<-q> ]>
 S<[ B<-Q> ]>
 S<[ B<-r> E<lt>infileE<gt> ]>
-S<[ B<-R> E<lt>read (display) filterE<gt> ]>
+S<[ B<-R> E<lt>Read filterE<gt> ]>
+S<[ B<-Y> E<lt>displaY filterE<gt> ]>
 S<[ B<-s> E<lt>capture snaplenE<gt> ]>
 S<[ B<-S> E<lt>separatorE<gt> ]>
 S<[ B<-t> ad|a|r|d|dd|e ]>
@@ -611,13 +612,33 @@ Read packet data from I<infile>, can be any supported capture file format
 (including gzipped files).  It's B<not> possible to use named pipes
 or stdin here!
 
-=item -R  E<lt>read (display) filterE<gt>
+=item -R  E<lt>Read filterE<gt>
 
 Cause the specified filter (which uses the syntax of read/display filters,
 rather than that of capture filters) to be applied before printing a
 decoded form of packets or writing packets to a file; packets not
 matching the filter are discarded rather than being printed or written.
 
+See the '-Y' option for information about using this at the same time the
+'-Y' option is used.
+
+=item -Y  E<lt>displaY filterE<gt>
+
+Cause the specified filter (which uses the syntax of read/display filters,
+rather than that of capture filters) to be applied before printing a
+decoded form of packets or writing packets to a file.  Packets matching the
+filter are printed or written to file; packets that the matching packets 
+depend upon (e.g., fragments), are not printed but are wrtitten to file;
+packets not matching the filter nor depended upon are discarded rather 
+than being printed or written.  This mode also performs a two-pass
+analysis as is done with the '-2' option, without needing '-2' to be set.
+
+If the '-R' read filter option is also set, then the read filter is applied
+first, and only packets passing that will be considered for the display
+filter, including dependent packets.  In other words, if the '-R' filters
+out fragments, they will not be included even if a packet matching the 
+display filter depended on the fragments.
+
 =item -s  E<lt>capture snaplenE<gt>
 
 Set the default snapshot length to use when capturing live data.