ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 10136] Capture Filter BPF expression mangled after re-open

Date: Tue, 27 May 2014 05:31:48 +0000

Comment # 1 on bug 10136 from
Just to clarify, it is not necessary to have () in the _expression_. The
expressions:

not host 192.0.2.44 and not port 123
not host 192.0.2.44 and not tcp port 123

Are all also mangled into:

not tcp port 123

--

After further testing it seems the displayed Capture Filter shows always
completely wrong data after capture is started, stopped and the Capture Options
dialog re-opened. After above testing trying to enter different Capture Filter
values:

not tcp port 987
host 127.0.0.1

Results in a mangled _expression_ still displaying the same _expression_ used in
previous testing and nothing anything close to the _expression_ that was entered:

not tcp port 123

The above behavior (displayed port staying at "123") persists even after
restart of Wireshark. Case:
1- start wireshark
2- set Capture Options to include Capture Filter "not host 192.0.2.99 and not
tcp port 123"
3- start capture
4- stop capture
5- open Capture Options, verify that Capture Filter is displayed as:
not tcp port 123
6- exit wireshark
7- start wireshark
8- set Capture Options to include Capture Filter "host 192.0.2.1"
9- start capture
10- stop capture
11- open Capture Options, verify that Capture Filter is displayed as:
not tcp port 123


You are receiving this mail because:
  • You are watching all bug changes.