Wireshark-bugs: [Wireshark-bugs] [Bug 11713] New: Qt Wireshark - Phantom display filter in effec
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 16 Nov 2015 02:00:51 +0000
Bug ID 11713
Summary Qt Wireshark - Phantom display filter in effect after a File -> Merge...
Product Wireshark
Version unspecified
Hardware x86
OS Mac OS X 10.10
Status UNCONFIRMED
Severity Minor
Priority Low
Component Qt UI
Assignee bugzilla-admin@wireshark.org
Reporter jyoung@gsu.edu 

Created attachment 14009 [details]
TinyTcpSession.pcapng

Build Information:
Version 2.1.0-570-g6012ba8 (v2.1.0rc0-570-g6012ba8 from unknown)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.3.2, with libpcap, without POSIX capabilities, with
libz 1.2.5, with GLib 2.36.0, with SMI 0.4.8, without c-ares, without ADNS,
with
Lua 5.2, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP,
with QtMultimedia, without AirPcap.

Running on Mac OS X 10.10.5, build 14F1021 (Darwin 14.5.0), with locale C, with
libpcap version 1.5.3 - Apple version 47, with libz 1.2.5, with GnuTLS 2.12.19,
with Gcrypt 1.5.0.
Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz (with SSE4.2)

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
After using the Merge Capture File feature (File -> Merge...), any active
display filter present will be cleared from the display filter input field but
will still active potentially limiting what packets appear in the packet list. 
There will be no display filter widget [X] available to clear the now phantom
display filter.

Steps to reproduce:

1 - Open Qt Wireshark

2 - Open the attached sample capture file: TinyTcpSession.pcapng 

3 - Set a display filter to show a subset of the capture: tcp.flags.syn==1

Only frames 1 and 2 of the 13 packet capture  will be listed.

4 - With the display filter still present select File -> Merge... to open the
Merge Capture File dialog.

5 - Open the same TinyTcpSession.pcapng capture.

Only four packets will be displayed in the Packet List but the no display
filter will be displayed.  The bottom status field will report:

> Packets: 26 . Displayed: 4 (15.4%)

There will be no [X] Widget in the display filter to clear the phantom
"tcp.flags.syn==1" filter.

Workaround:

To clear the phantom display filter, apply any valid display filter (for
example "ip") and then clear it.  All packets will now be visible.

You are receiving this mail because:
  • You are watching all bug changes.