ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-users: Re: [Ethereal-users] display filter problem...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Thu, 19 Jan 2006 00:20:04 +1100
David Meagher wrote:
> I've got the exact same issue
> win 2000 running ethereal 0.10.14
> it didn't happen on any previous version (ever version since 9.x)

This annoys me enough (on Windows XP) that I've given up typing
ip.addr== filters into the box.

I fire up a text editor, type the expression there, copy and paste it
into the box.

No delay. I've suggested this to everyone else at $DAYJOB who has
mentioned it.

> Having said that - i'm happy to wait - its still an excellent product i
> use ever day - great job and thanks!
> 
> On 17/01/06, *Jack Jackson* <jack@xxxxxxxxxxxxxxx
> <mailto:jack@xxxxxxxxxxxxxxx>> wrote:
> 
>     The delay seems to occur in two circumstances once 'ip.addr==' has been
>     entered:
> 
>     1.  When a digit is typed.  There is no delay when a non-digit is
>     typed.  Also note that if multiple digits are typed rapidly, there
>     is only
>     one delay - all typed digits appear after the delay.
>     2.  When backspacing removes a digit that is preceeded by another
>     digit.  There is no delay when backspacing removes a digit that is
>     preceeded by a period or other non-digit.
> 
>     I don't see any delays in 0.10.12.
> 
>     At 02:07 PM 1/17/2006, DAIGLE, ANDREW PAUL wrote:
>     >Forgive me if I'm mis-reading your response, Guy, but this is a new
>     issue
>     >that just started in version 0.10.14 . Filter validation is
>     certainly not
>     >new to 0.10.14, but the long delay when entering ip address filters is.
>     >
>     >I have tried it on multiple WinXP and Win2K machines and it has
>     occurred
>     >on every one. To recreate, do the following:
>     >
>     >Open Ethereal. In the display filter box, type (without stopping):
>     >
>     >ip.addr == 192.168.1.1 <http://192.168.1.1>
>     >
>     >The display will stop updating after "ip.addr ==" and Ethereal becomes
>     >completely unresponsive for 10-15 seconds. The workstation itself
>     does not
>     >hang, only Ethereal. CPU utilization during the delay remains very
>     low (2%).
>     >
>     >I am still running version 0.10.13 on another machine and there is no
>     >delay whatsoever when entering the above display filter. There was a
>     >definite and significant increase in the validation time for
>     "ip.addr ==",
>     >"ip.src ==" and "ip.dst ==" display filters in 0.10.14.
>     >
>     >As noted below, someone has reported this bug on bugzilla:
>     >http://bugs.ethereal.com/bugzilla/show_bug.cgi?id=658
>     >
>     >Andrew
>     >
>     >
>     >
>     >-----Original Message-----
>     >From: Guy Harris [mailto:gharris@xxxxxxxxx <mailto:gharris@xxxxxxxxx>]
>     >Sent: Tuesday, January 17, 2006 2:38 PM
>     >To: Ethereal user support
>     >Subject: Re: [Ethereal-users] display filter problem...
>     >
>     >andre.noel@xxxxxxxxxxx <mailto:andre.noel@xxxxxxxxxxx> wrote:
>     >
>     > > I upgraded to the last version  of ethereal ( 0.10.14 ) on all my
>     > > capture PC and every time
>     > >
>     > > I tried to do a display filter  like   ip.addr==192.168.2.10
>     (can be any
>     > > Ip address) ethereal seems
>     > >
>     > > to hang  or take very long time to display the keystroke (numbers)
>     >
>     >         http://bugs.ethereal.com/bugzilla/show_bug.cgi?id=658
>     >
>     >(This is not new in 0.10.14; the code to color the background of
>     display
>     >filters red if the text in the field is not a valid filter and green if
>     >it is has been there for a long time, and that's almost certainly the
>     >cause of this problem.)


-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who