Wireshark-bugs: [Wireshark-bugs] [Bug 11786] "Delta time displayed" column in Wireshark doesn't
Jim Young
changed
bug 11786
| What |
Removed |
Added |
| Status |
UNCONFIRMED
|
CONFIRMED
|
| Ever confirmed |
|
1
|
| OS |
Windows 7
|
All
|
Comment # 5
on bug 11786
from Jim Young
I was able to reproduce the issue with Delta Displayed on Windows 8.1 and on OS
X. Interestingly the malformed Delta Displayed symptom could be easily
replicated with Qt interface but was harder to reproduce with GTK (legacy)
interface.
Steps to reproduce:
1 - Start Qt Wireshark.
2 - Add two new Time columns:
2.a - For the first new column set Type to "Custom", set Filter to
"frame.time_delta_displayed" and name it "Delta1".
2.b - For the second new column set Type to "Delta time displayed" and name it
"Delta2".
3 - Set the default Time column to also display delta displayed. (View -> Time
Display Format -> Seconds Since Previously Displayed Packet).
4 - Open up the attached capture.
5 - In the Packet list expand the Frame tree so as to be able to see the
various [Time delta *] entries.
6 - Apply display filter of: "tcp.stream == 6"
At this point all three Time columns will display identical but incorrect
values. While we expect all three Time columns to display the Delta Displayed
value, the time value displayed appears to be the Delta Captured value as can
be seen by selecting one of the displayed packets and comparing the packet list
time values with the various time values displayed in the expanded Frame tree.
A reload of the capture file will cause the three time columns to display the
actual Delta Displayed value. (Switching the Time column to display another
type will also cause the Delta1 and Delta2 columns to display the expected
value).
If you clear the display filter, reload the capture file and then re-apply the
display filter the issue will reappear.
With the GTK (legacy) version only the "Delta1" column (the custom column)
would display the wrong time BUT the issue could not be consistently replicated
using the steps documented above.
You are receiving this mail because:
- You are watching all bug changes.
