ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-users: RE: [Ethereal-users] display filter problem...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Tue, 17 Jan 2006 14:29:57 -0800
The delay seems to occur in two circumstances once 'ip.addr==' has been entered:

1. When a digit is typed. There is no delay when a non-digit is typed. Also note that if multiple digits are typed rapidly, there is only one delay - all typed digits appear after the delay. 2. When backspacing removes a digit that is preceeded by another digit. There is no delay when backspacing removes a digit that is preceeded by a period or other non-digit.

I don't see any delays in 0.10.12.

At 02:07 PM 1/17/2006, DAIGLE, ANDREW PAUL wrote:
Forgive me if I'm mis-reading your response, Guy, but this is a new issue that just started in version 0.10.14. Filter validation is certainly not new to 0.10.14, but the long delay when entering ip address filters is.

I have tried it on multiple WinXP and Win2K machines and it has occurred on every one. To recreate, do the following:

Open Ethereal. In the display filter box, type (without stopping):

ip.addr == 192.168.1.1

The display will stop updating after "ip.addr ==" and Ethereal becomes completely unresponsive for 10-15 seconds. The workstation itself does not hang, only Ethereal. CPU utilization during the delay remains very low (2%).

I am still running version 0.10.13 on another machine and there is no delay whatsoever when entering the above display filter. There was a definite and significant increase in the validation time for "ip.addr ==", "ip.src ==" and "ip.dst ==" display filters in 0.10.14.

As noted below, someone has reported this bug on bugzilla:
http://bugs.ethereal.com/bugzilla/show_bug.cgi?id=658

Andrew



-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx]
Sent: Tuesday, January 17, 2006 2:38 PM
To: Ethereal user support
Subject: Re: [Ethereal-users] display filter problem...

andre.noel@xxxxxxxxxxx wrote:

> I upgraded to the last version  of ethereal ( 0.10.14 ) on all my
> capture PC and every time
>
> I tried to do a display filter  like   ip.addr==192.168.2.10 (can be any
> Ip address) ethereal seems
>
> to hang  or take very long time to display the keystroke (numbers)

        http://bugs.ethereal.com/bugzilla/show_bug.cgi?id=658

(This is not new in 0.10.14; the code to color the background of display
filters red if the text in the field is not a valid filter and green if
it is has been there for a long time, and that's almost certainly the
cause of this problem.)