https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6054
Summary: Byte sequences unnecessarily painful
Product: Wireshark
Version: 1.6.0
Platform: x86
OS/Version: Windows 7
Status: NEW
Severity: Normal
Priority: Low
Component: Documentation
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: dalestan@xxxxxxxxx
Build Information:
Wireshark 1.6.0 (SVN rev 37592 from /trunk-1.6)
--
Note: Because I need to put double quote characters in quotes, I am enclosing
literal strings in guillemets («»). Thus, «"thing"» is a seven-character
string, where the first and last characters are both 0x22.
I have a capture that I was inspecting, and I wanted to find packets where the
TCP data contained «PRSRT». So I did the obvious (to me) thing:
I opened the capture.
I clicked the «Expression...» button.
I found and selected tcp.data in the left-most box.
I selected «contains» for the relation.
I typed «PRSRT» into the Value textbox.
I clicked OK.
I see no reason why this shouldn't just plain *work*. But it didn't. Instead,
Wireshark unhelpfully informed me that «"PRSRT" is not a valid byte string.» No
fanfare, no suggestions, no *anything*.
I scratched my head a bit, and tried «"PRSRT"», «50 52 53 52 54» and
«5052535254». None worked, with the same error. («""PRSRT"" is not a valid byte
string.», etc.)
I then went to the help, and searched for «byte string». This was equally
unhelpful.
The table of contents suggested section 6.5, which was also unhelpful.
I finally wandered around to sections 6.3 and 6.4, before managing to find
enough clues to determine that I was supposed to say «50:52:53:52:54».
I would like to see all of the following:
1) An option to enter byte sequences in the Filter Expression dialog as ASCII
instead of hex, as is allowed in the Filter box on the main form.
2) An error message that contains something that can be used to find the
correct help page.
«Sequence of bytes» is one such string.
3) A description in section 6.5 of what should be entered in the Filter
Expression dialog when the value caption says «Value (sequence of bytes)».
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
