I am doing some capturing using tshark for troubleshooting and got a strange behavior:
I produced a capture file (pcap) with dumpcap and converted it to json with tshark. I then noticed that the headers of some requests (http.request.line) got duplicates of various values (like a long list of headers and values).
For example, I got in the same http.request.line 24 unique User-Agent values, 5 unique Accept values etc...
I did the conversion on an Ubnutu 18.04.4 LTS and tshark version 2.6.10.
I then tries this conversion on a different Ubuntu distribution (Ubuntu 20.04.4 LTS and tshark version 3.2.3) with the same pcap file and got no duplication.
Did you encounter anything like this between those versions?
