Wireshark-bugs: [Wireshark-bugs] [Bug 6054] New: Byte sequences unnecessarily painful
Date: Wed, 22 Jun 2011 11:39:45 -0700 (PDT)

           Summary: Byte sequences unnecessarily painful
           Product: Wireshark
           Version: 1.6.0
          Platform: x86
        OS/Version: Windows 7
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: Documentation
        AssignedTo: [email protected]
        ReportedBy: [email protected]

Build Information:
Wireshark 1.6.0 (SVN rev 37592 from /trunk-1.6)
Note: Because I need to put double quote characters in quotes, I am enclosing
literal strings in guillemets («»). Thus, «"thing"» is a seven-character
string, where the first and last characters are both 0x22.

I have a capture that I was inspecting, and I wanted to find packets where the
TCP data contained «PRSRT». So I did the obvious (to me) thing:
I opened the capture.
I clicked the «Expression...» button.
I found and selected tcp.data in the left-most box.
I selected «contains» for the relation.
I typed «PRSRT» into the Value textbox.
I clicked OK.

I see no reason why this shouldn't just plain *work*. But it didn't. Instead,
Wireshark unhelpfully informed me that «"PRSRT" is not a valid byte string.» No
fanfare, no suggestions, no *anything*.
I scratched my head a bit, and tried «"PRSRT"», «50 52 53 52 54» and
«5052535254». None worked, with the same error. («""PRSRT"" is not a valid byte
string.», etc.)
I then went to the help, and searched for «byte string». This was equally
The table of contents suggested section 6.5, which was also unhelpful.

I finally wandered around to sections 6.3 and 6.4, before managing to find
enough clues to determine that I was supposed to say «50:52:53:52:54».

I would like to see all of the following:
1) An option to enter byte sequences in the Filter Expression dialog as ASCII
instead of hex, as is allowed in the Filter box on the main form.

2) An error message that contains something that can be used to find the
correct help page.
«Sequence of bytes» is one such string.

3) A description in section 6.5 of what should be entered in the Filter
Expression dialog when the value caption says «Value (sequence of bytes)».

Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.