tshark displays MATE fields in frames differently from Wireshark, use of -2 (two-pass handling) together with a display or read filter removes them completely instead of helping it
This issue was migrated from bug 12161 in our old bug tracker.
Original bug information:
Reporter: Pavel Sindelka
Status: RESOLVED FIXED
Product: Wireshark
Component: TShark
OS: All
Platform: All
Version: 2.0.1
Attachments:
subscribe_notify_filtered.pcapng: a sample capture of a SUBSCRIBE-initiated SIP dialog
subscribe_notify.txt: a sample MATE configuration file