Wireshark-bugs: [Wireshark-bugs] [Bug 10136] New: Capture Filter BPF expression mangled after re
| Bug ID |
10136
|
| Summary |
Capture Filter BPF _expression_ mangled after re-open "Capture Options" dialog (OK on Win7)
|
| Classification |
Unclassified
|
| Product |
Wireshark
|
| Version |
1.11.x (Experimental)
|
| Hardware |
x86-64
|
| OS |
Windows Server 2008 R2
|
| Status |
UNCONFIRMED
|
| Severity |
Minor
|
| Priority |
Low
|
| Component |
Wireshark
|
| Assignee |
bugzilla-admin@wireshark.org
|
| Reporter |
ville.ojamo@cidc.com.kh
|
Build Information:
Version 1.11.3 (v1.11.3-0-g1dd5d3a from master)
Copyright 1998-2014 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 2.24.14, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.34.1, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.2, without Python, with GnuTLS 2.12.18, with Gcrypt 1.4.6,
with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Apr 15 2014),
with AirPcap.
Running on 64-bit Windows Server 2008R2 Service Pack 1, build 7601, with
WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version
1.0 branch 1_0_rel0b (20091008), GnuTLS 2.12.18, Gcrypt 1.4.6, without AirPcap,
from the PortableApps U3 device in drive C:.
Intel(R) Xeon(R) CPU E5520 @ 2.27GHz, with 2047MB of physical
memory.
Built using Microsoft Visual C++ 10.0 build 40219
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
Official x86-64 Windows installer executable 1.11.3, bug also present on latest
stable 1.10.7-g6b931a1. Problem appears only on a completely updated Windows
Server 2008R2 and is not present on an updated Windows 7.
Capture Filter that is slightly complex is working properly but it is "mangled"
after re-opening Capture Options dialog. Multiple stop/start of capture
confirms the BPF _expression_ is working as expected. Opening of the Capture
Options dialog displays a mangled BPF _expression_ in the Capture Filter fields
(in interface list and input textbox). If that mangled Capture Filter is
accepted by choosing "Start" the mangled BPF _expression_ is applied and wrong
data is captured. The correct BPF _expression_ is shown in Capture Filter
history.
How to replicate:
1- when configuring capture options, enter a BPF _expression_ for Capture Filter
that contains () and some other content, for example one of:
not (host 192.0.2.44 and port 123)
not (host 192.0.2.44 and tcp and port 123)
not host 192.0.2.44 and not port 123
2- start capture
3- stop capture
4- open "Capture Options" dialog again
5- confirm that displayed "current" Capture Filter has changed, "Capture
Filter" field both in interface list and on textbox is changed. Capture Filter
history shows correct _expression_ in the latest entry. Following the above
examples the current Capture Filter is in all example cases set to:
not tcp port 123
Expected behavior:
Capture Filter should stay the same as was originally entered.
Workaround:
Choose the latest (the one that was originally entered) entry in Capture Filter
history before clicking "Start" in the "Capture Options" dialog.
You are receiving this mail because:
- You are watching all bug changes.
