| Bug ID |
8344
|
| Summary |
stealth display filter - display field cleared but still active after opening new file
|
| Classification |
Unclassified
|
| Product |
Wireshark
|
| Version |
1.9.x (Experimental)
|
| Hardware |
All
|
| OS |
All
|
| Status |
UNCONFIRMED
|
| Severity |
Minor
|
| Priority |
Low
|
| Component |
Wireshark
|
| Assignee |
[email protected]
|
| Reporter |
[email protected]
|
Build Information:
Version 1.9.0-SVN-47696 (SVN Rev 47696 from /trunk)
Copyright 1998-2013 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GTK+ 2.24.10, with Cairo 1.8.6, with Pango 1.30.0, with
GLib 2.32.3, with libpcap, with libz 1.2.3, without POSIX capabilities, without
libnl, with SMI 0.4.8, without c-ares, without ADNS, with Lua 5.1, without
Python, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP,
with PortAudio V19-devel (built Aug 12 2012 22:27:54), with AirPcap.
Running on Mac OS X 10.6.8, build 10K549 (Darwin 10.8.0), with locale .UTF-8,
with libpcap version 1.0.0, with libz 1.2.3, GnuTLS 2.12.19, Gcrypt 1.5.0,
without AirPcap.
Intel(R) Core(TM)2 Duo CPU T9600 @ 2.80GHz
Built using gcc 4.2.1 (Apple Inc. build 5666) (dot 3).
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
After certain GUI actions the contents of the Wireshark display "Filter:" text
entry field will be cleared but the previous applied display filter will still
be in use.
The following steps can be used to replicate this problem:
1 - Start wireshark
2 - Using the File menu's "Open" dialog load the first (trivial) trace file:
ten-frames.pcap
Wireshark should display ten frames in the packet list window.
3 - Apply the following display filter: frame.number==3
Only one frame (#3) should be listed in the packet list window.
4 - Using the File menu's "Open" dialog load the second (trivial) trace file:
one-frame.pcap
As expected no packets will be displayed because there is no frame #3 in newly
opened one-frame.pcap file. But the contents of display filter field has been
cleared implying that there is no active display filter.
5 - Edit and apply the following display filter: frame.number==1
Now the first (and only) frame #1 of the trace file will be displayed.
6 - Using the File menu's "Open" dialog load (for the second time) the first
trace: ten-frames.pcap
Only one frame (#1) will be displayed yet the display filter field will be
empty.
A similar behavior occurs when a new capture is initiated; the display filter
field is cleared but the previous applied display filter is still in effect.
This behavior seen in the buildbot versions of Wireshark trunk on both OSX and
32-bit Windows and also with on Qtshark for 32-bit Window. Wireshark 1.8.5
does not appear to have this issue.
You are receiving this mail because:
- You are watching all bug changes.
