Lab 23 is not displaying as expected in the bookmark filters menu. Could it be because there is a difference with the new version of Wireshark?
The dfilters_sample.txt when added to my personal dfilters in Wireshark the Lab shows that it should look like a multi-line output. I do not get that. I get a single line with the entire filter as one filter with no separation. Even the filter bar is red. I am not sure if this is because of the newer version of Wireshark compared to when the file was created. If something changed. I have tried a few things but I am not sure what I am missing. This is not hard to copy and paste. I am using the Wireshark Version 3.2.7 (v3.2.7-0-gfb6522d84a3a).
Thanks
What operating system are you working on and what program is being used to edit dfilters?
I am on Windows 10. I have used both the program Notepad and Wordpad to try and edit the files.
I think it's a bug but haven't figured out when it came in or how.
The file formats are a mix of CR/LF and once Wireshark saves it out an extra CR gets added.
Do you have the option of editing with vi (vim) or Notepad++?
In vi, delete the extra
^Mat the end of the lines.In Notepad++, use
Edit->EOL Conversion->Windows (CR LF)to fix the lines missing a LF.Where is this dfilters_sample.txt file?
In the Book Supplements
I appended the dfilters_sampe.txt contents to the default dfilters file, and everything looks fine, but I am still using [a customized version of] 3.2.6. Is the problem resolved with 3.2.6? If so, then maybe some bug was introduced with 3.2.7.
It's Windows specific and after the default is read in and written back out to a dfilters in the profile directory.
So I see the extra carriage return, but the steps to reproduce it seem to be:
OK. This will cause the dfilters file to be re-written by Wireshark, which will only then introduce the extraneous carriage returns.I've done this; however, after closing Wireshark and re-opening it again, the display filters still seem to be read just fine and are just as usable as before. If there's something else one needs to do to reproduce the problem, then I guess I'm missing it. (A Wireshark Issue should probably be opened so the extraneous carriage return can be fixed, but at ...(more)
NOTE: You don't actually have to add any new display filters to see the extra carriage return added, as merely clicking
OKin the Display Filters dialog will do that, regardless of whether you added any new filters or not.It's was late and I got brain ache - tried fopen binary - didn't help. Behaves different on Linux.
In your step #1 above did you add it to the global dfilters file? It would work in that case.
It's when you want to add to a specific profile dfilters that the problem comes in.
So I think a bug but wanted to provide something more than "it's broke" before opening an issue.
Yes, I was working with the global dfilters file. I repeated the process with a profile dfilters file, but the behavior is the same and it still works despite the extraneous carriage returns. Since my version of Wireshark is customized, perhaps there's another difference that allows it to work for me, such as the fact that I'm running Qt 5.15.0. For reference, here are my Version 3.2.6 details:
(more)It also depends on the editor. I can make it work with vi or Notepad++.
If you have steps to a good file using
notepadthen the original question could use that as an answer.Sorry, I was gone, I do have access to notepad++ and vi. I will try to add it there and see the results I get.
I got it to wok with Notpad++. I took advice from Chuckc about viewing the hidden characters. I saw a pattern with the CR(Carriage Return) and LF(Line Feed). I then matched how the rest of the file was set up. Which is a CR at the end of the line and then a CRLF on the blank line. It now looks like the book suggests.
I am not sure if this is a bug issue or not. From a normal user, you hit the enter key and expect to do what you need. I was unsure what the CR and LF meant so I looked that up and found this site that discussed how to find and replace the hidden characters (link below). I just replaced everything I needed to so that it looked the same as the previous lines.
Thanks for looking into this. Great ideas here ...(more)
Now I am not sure how to show that this is now answered.
Maybe one of the more senior members will see this and weigh in.
The comments above are a work around for your issue but still trying to resolve how things "should work". :-)