Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] How do I apply the Display filter ??

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 31 Aug 2002 15:28:05 -0700
On Sat, Aug 31, 2002 at 09:56:04PM +0200, Thomas wrote:
> Ouch! NOW I clicked the "Filter" button and get the dialog with
> "Apply" and "OK" buttons !!
> Previous I only tried the "Reset" and "Apply" buttons to the right, I
> thought the "Filter" was just a descriptive text field !!

No, it's a text box into which you can type a filter expression; you
don't have to use the GUI to construct an expression.  "Reset" clears
the filter and "filters" with the clear filter expression (i.e.,
un-filters the display); "Apply" applies the filter in that text box to
the display (as does typing the Enter key in that box).

It may be that having "Capture Filters" and "Display Filters" as items
under the "Edit" menu causes some confusion.  Those are intended to let
you edit the lists of saved capture filters and saved display filters,
but sometimes people seem to think they're what you use to *apply* a
filter - they're not.

You can edit those lists from the dialog boxes popped up by the
"Filter:" button in the "Capture Options" dialog box (that dialog box
lets you select filters from the list of saved capture filters, save a
filter to that list with a name, or edit that list) and the "Filter:"
button at the bottom of the main window (that dialog box lets you select
filters from the list of saved display filters, save a filter to that
list with a name, or edit that list).

It may be that, most if not all of the time, you'll only be editing that
list when constructing a capture or display filter, so it may be that
it's sufficient to have the filter list editing functions available then.