Wireshark · Wireshark-dev: Re: [Wireshark-dev] FT_TYPE appropiated?

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

On Wed, Mar 16, 2016 at 10:14 AM, Juan Jose Martin Carrascosa <juanjo@xxxxxxx> wrote:

Hi all,

I have a field that has the following content (hex bytes):

0a00020f00007cfb00000001

If I use FT_STRING, it displays 0a\n. Thus, I decided to use FT_BYTES. 

The problem now is that when I do right-click -> Apply as column, if I do right-click in the column and do "apply as filter" or "prepare a filter", it interprets the content as FT_STRING. Thus, the filter created by the column doesn't work.

What options do you think I have here? I don't mind changing the representation of the field or fixing the column, but anything that works!

It sounds like FT_BYTES is what you should be using.

But what you're running into is a bug (maybe not many people create filters from columns?).  Please open a bug report.