Wireshark-bugs: [Wireshark-bugs] [Bug 11836] Can't enter a Capture Filter in the new GUI
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sun, 27 Dec 2015 06:48:34 +0000

Comment # 5 on bug 11836 from 
(In reply to VC from comment #4)
> I'm able to enter the filter directly in the box, although, the filter stays
> red if no interface is selected, and it turns green as soon as I select an
> interface.

Without knowing on which interfaces the capture will be done, it's impossible
to determine whether the capture filter is valid or not - the way it's
determined is by trying to compile it with libpcap/WinPcap, and that requires a
link-layer header type.

We could disable the checking if no interface is selected, so that the box is
neither red nor green.

(Doing better would either require duplicating the libpcap/WinPcap parsing
code, which runs the risk of Wireshark's parser not being the same as the
parser in the version of libpcap/WinPcap you're using - and, yes, new features
have been added to the capture filter language over time, so the version of
libpcap/WinPcap matters - or adding to libpcap and WinPcap the ability to parse
without generating BPF code and disabling any "this only works with this
link-layer header type" checks.)

You are receiving this mail because:
  • You are watching all bug changes.