Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

There is a pcap attached to this Bugzilla for testing.

Tshark extract: 2030180 Apr 16 16:12 002804-1-Secondary-Capture-Image-Storage.dcm
Wireshark extract:  2029854 Apr 16 16:14 002804-1-

The start of each filename contains the last packet/frame number (2804) of the object:

filename = wmem_strdup_printf(wmem_packet_scope(), "%06d-%d-%s.dcm", pinfo->num, cnt_same_pkt,
  g_strcanon(pdv_curr->sop_instance_uid, G_CSET_A_2_Z G_CSET_a_2_z G_CSET_DIGITS "-.", '-'));

$ tshark -r ./test.cap -Y "frame.number==2804" -T fields -e ip.src -e ip.dst