ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 2332] Everytime I or anyone in my workgroup create a Filte

Date: Thu, 17 Apr 2008 05:57:34 -0700 (PDT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2332


Mathias Rufer <mathias.rufer@xxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mathias.rufer@xxxxxxxx




--- Comment #3 from Mathias Rufer <mathias.rufer@xxxxxxxx>  2008-04-17 05:57:33 GMT ---
I have the same problem and this is really embarassing! Firefox stalls when
typing an ip address filter in the display filter.
Network name resolution in Wireshark is DISABLED
But I can see ARP requests for the DNS servers, so it tries anyway.

Reproduce it:
- connect network interface on a monitoring switchport (tx only, also called
SPAN port)
- network interface eth0.avah assigns 169.254.x.y auto address
- launch Wireshark as root
- do a capture
- type ip.addr==1.2.3.4 in the display filter bar (or try)
- when typing the first dot of the IP address, Wireshark freezes for a while

Not sure if this is a Wireshark or an Ubuntu bug, but it sure is annoying and
makes display filters useless.

Linux system is Ubuntu 7.10

Some more info.

ifconfig
eth0      Link encap:Ethernet  HWaddr 00:11:43:xx:xx:xx  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2691849 errors:0 dropped:0 overruns:0 frame:0
          TX packets:276 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:422142939 (402.5 MB)  TX bytes:30958 (30.2 KB)
          Interrupt:11 

eth0:avah Link encap:Ethernet  HWaddr 00:11:43:xx:xx:xx  
          inet addr:169.254.7.62  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:52 errors:0 dropped:0 overruns:0 frame:0
          TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4420 (4.3 KB)  TX bytes:4420 (4.3 KB)


Version 0.99.6

Compiled with GTK+ 2.12.0, with GLib 2.14.1, with libpcap 0.9.7, with libz
1.2.3.3, with libpcre 7.4, without Net-SNMP, with ADNS, without Lua, with
GnuTLS
1.6.3, with Gcrypt 1.2.4, with MIT Kerberos, with PortAudio <= V18, without
AirPcap.

Running on Linux 2.6.22-14-generic, with libpcap version 0.9.7.

Built using gcc 4.1.3 20070929 (prerelease) (Ubuntu 4.1.2-16ubuntu2).


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.