Ethereal-users: Re: [Ethereal-users] ethereal 0-8-15 crash in filter expression

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Thu, 22 Feb 2001 22:03:29 -0800
On Thu, Feb 22, 2001 at 12:11:15PM +0100, Theodore Marescaux wrote:
> I select a packet I want to filter out, then right click to get Display
> Filters. Click on Add Expression. Then I get some GTK errors...

...which are the result of the same problem that causes the later crash.

I've checked in a fix, so the next nightly "build" (which is really just
a nightly CVS snapshot), as well as the next release, should have the
fix.

Note, however, that the "Display Filters..." menu item is just an alias
for "Edit->Filters..." - it doesn't let you set the current display
filter, it just lets you add new entries to the stored list of filters,
or delete entries from it.

Even if it were changed to an alias for the "Filter:" button at the
bottom of the window, it wouldn't matter which packet you selected - the
only filter guaranteed to filter out the selected packet would be

	frame.number != N

where N is the number of the current frame; any other filter expression
could conceivably filter out other frames as well.  (If by "filter out"
you mean you want to *include* that frame, the previous statement still
applies, except that the expression would be

	frame.number == N

.)

Given that, and given that there could be several fields in the current
packet that could be filtered, it wouldn't be possible to construct a
display filter from the current frame.

In order to construct a filter from the current frame, you'd need to
select a given field; in the protocol tree pane, if you've selected a
line, you can use the "Match Selected" item in the right-mouse-button
menu.  If the line has a field associated with it, it filters the
display to show packets with the same value, otherwise it filters the
display to show packets with the same bytes at the same offset as the
data for that line.

> Finally, this bug doesn't happen when I click Filter (bottom left)  and
> then Display Filters... Is this only a GTK problem ???

No, it's a problem with "Edit->Filters...", for which, as noted,
"Display Filters..." is an alias.  (The same problem happens if you
select "Filters..." - or, in the current CVS version, "Display
Filters..." - from the "Edit" menu.)