 | 1 | initial version |
This is most likely due to Wireshark saving all dependent frames along with the displayed frames. See Bug 7667.
If you don't want dependent frames to be saved, then there are a few work-arounds, as mentioned in the bug report. My suggestion in Comment 14 was to mark all displayed packets after applying the display filter, and then instead of exporting all displayed frames, export all marked frames. I believe that work-around should still work if you really don't want the dependent frames saved, but keep in mind that if you don't also export the dependent frames, then things like reassembly won't work. Generally it's a good idea to export the dependent frames unless you have a very specific reason not to.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
