Wireshark-users: Re: [Wireshark-users] How to "unsort"
From: Jim Young <jyoung@xxxxxxx>
Date: Wed, 16 Mar 2016 22:28:03 +0000
On behalf of Perry Smith <pedzsan@xxxxxxxxx>
> I’ve seen one application where each click cycles through “sort up”,
> “sort down”, and “sort off” (but I can’t recall where).  Wireshark
> already has “sort up” and “sort down” and cycles back to “sort up”.
>
> The other thought is the menu that right click pops up, turn off
> sort could be there but that doesn’t seem like a good design.

I believe Wireshark's legacy GTK based packet list column headers
have the tri-state feature you are describing.  That's the feature you
are missing from the new Qt based UI packet list sort.

With both the GTK and Qt Wireshark when you first open an existing
capture or start a new capture there is no indicator as to what column
the packet list is sorted by; but the packet list is by default sorted by
the "No." column.

Once you click on any packet list header label the sort indicator will
appear on that label indicating the sort direction and concurrently 
the sort commences.

With the GTK UI you could click on the same header label twice more
get back to the default "No." column sort.

With the new UI to get back to the default "No." column sort after
intentionally or unintentionally (see below) sorting by something
other than the frame number you must click on the "No." header
label once to get back to the default sort state.   Unlike when you
first opened a capture or started a capture the column header
label for "No." will now persistently display the sort direction
indicator.  You can only clear this sort indicator by closing the
current capture (returning back to Wireshark's Welcome screen).

Regarding unintentional sorts.   I find myself occasionally entering
an accidental stray primary click which commences an unintentional
sort when all I really wanted was to do was open the column header
(right-click) context menu.   I chalk that up to me being a bit sloppy
with the pointer and clicks, not a bad design.  

Hope this helps,

Jim Y.