Hi,
I've selectively ignored a couple of packets in my dump and
when trying to overwrite the original capture file wireshark
refuses to do this with: "Capture file:
"/home/nion/work/osmocom/rach_bursts.pcap" identical to
loaded file!

Please choose a different filename."

This is a bit annoying especially since the file is _not_
the same. I saved this to an alternative file name and
diffed it with the original file. They are indeed different
and the new file is missing the ignored packets. So I can't
really understand why wireshark is refusing to save the file
under the same name.

Steps to reproduce:
- open a pcap file
- ignore a few packets by right-click -> Ignore Paket
- File -> Save As -> chose same file name, click radio
  button "Remove Ignored packets" -> Save
=> Error

Cheers
Nico

severity 581965 wishlist
thanks

Hi,

The files are the same in a sense that their filenames (and inodes)
are identical.

Wireshark can't save the packets to the file it opened, because it
does not store the whole file content in memory, thus it have to read
from the opened file while saving.

The problem could be solved by making a temporary copy.

Cheers,
Balint

2010/5/17 Nico Golde <nion@debian.org>:

Hi,
* Bálint Réczey <balint@balintreczey.hu> [2010-05-24 18:41]:

Ok makes sense to me.

That would be nice. Thanks!

Cheers
Nico