 | 1 | initial version |
The reason for the discrepancy is that the status bar is showing the actual number of frames displayed, whereas the "Export Specified Packets" dialog is showing the number of packets that will be exported, based on the displayed packets, but this includes not only the displayed packets, but the dependent frames as well.
For example, if you have fragmented ICMP packets displayed and a display filter of "icmp" applied, and then attempt to export the displayed packets, the number of packets that will be exported will be higher than the displayed number because Wireshark exports the fragments too so that the entire packet can be reassembled in the exported file.
