Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 4985] New: new_packet_list: inconsistant frame.time_delta_displayed values wit

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4985

           Summary: new_packet_list: inconsistant
                    frame.time_delta_displayed values within custom column
           Product: Wireshark
           Version: 1.5.x (Experimental)
          Platform: Other
        OS/Version: Windows XP
            Status: NEW
          Severity: Normal
          Priority: Medium
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: jyoung@xxxxxxx


Created an attachment (id=4885)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4885)
Test file with bootp (dhcp) and icmp packets

Build Information:
Version 1.5.0 (SVN Rev 33460 from /trunk)

Copyright 1998-2010 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.16.6, (32-bit) with GLib 2.22.4, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with
Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jul
 6 2010), with AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.1
(packet.dll version 4.1.0.1753), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, with AirPcap 4.1.0 build 1622.

Built using Microsoft Visual C++ 9.0 build 30729

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information

--
Problem:

A "delta displayed" custom column will not display the actual correct delta
displayed value.

Steps to reproduce:

Setup a custom column (call it "delta displayed") with the value of
"frame.time_delta_displayed".

Open up the attached 40 frame trace file.

With no display filter in place the contents of the "delta displayed" should be
identical to the value of Time Delta Captured.   

Using accelerator key-strokes Ctrl+Alt+5 (delta captured) and Ctrl+Alt+6 (delta
displayed) one can quickly swap the standard "Time" column between the two
delta modes.

Apply a display filter of "!icmp" and the following 16 frames are displayed:
1-6, 8-13, 18, 23, 39-40. 

Oddly with the display filter in place the delta time values displayed within
the "delta displayed" custom column for frames 8, 18, 23 will actually display
the value of the "delta captured" instead of the "delta displayed".  

Interestingly when the "!icmp" display filter is first applied frame 39 unlike
frames 8, 18 and 23 will display the expected "Delta displayed" value.

Select one of the incorrect cells and use the right-mouse click pop-up menu and
choose the "Prepare for filter : Selected" and the actual correct delta
displayed value will be written to the display filter textbox, not the
incorrect value displayed within the selected "delta displayed" cell.

After clearing the "!icmp" display filter all 40 frames will be displayed but
now frames 23 and 39 will display the wrong "delta displayed" value; the value
displayed will be the values as if the "!icmp" display filter was still in
place.

Forcing a Reload of the file (Ctrl+R) will cause the the custom "delta
displayed" column to immediately display the correct values.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.