Ask Your Question
0

empty capture filter is invalid capture filter

asked 2026-06-10 19:27:17 +0000

soy_pat gravatar image

updated 2026-06-10 19:31:34 +0000

Upgraded wireshark today now I can't use the empty filter. Can't use ether either as is said in man page. This is very frustrating.

      ~ pacman -S wireshark               
error: you cannot perform this operation unless you are root.
➜  ~ pacman -Ss wireshark
extra/termshark 2.4.0-2
    Terminal UI for tshark, inspired by Wireshark
extra/wireshark-cli 4.7.0-1 [installed]
    Network traffic and protocol analyzer/sniffer - CLI tools and data files
extra/wireshark-qt 4.7.0-1 [installed]
    Network traffic and protocol analyzer/sniffer - Qt GUI
➜  ~ sudo downgrade wireshark-qt
loading packages...
warning: downgrading package wireshark-qt (4.7.0-1 => 4.6.6-1)
resolving dependencies...
warning: cannot resolve "libwireshark.so=19-64", a dependency of "wireshark-qt"
warning: cannot resolve "libwiretap.so=16-64", a dependency of "wireshark-qt"
warning: cannot resolve "libwsutil.so=17-64", a dependency of "wireshark-qt"
:: The following package cannot be upgraded due to unresolvable dependencies:
      wireshark-qt

:: Do you want to skip the above package for this upgrade? [y/N]  
error: failed to prepare transaction (could not satisfy dependencies)
:: unable to satisfy dependency 'libwireshark.so=19-64' required by wireshark-qt
:: unable to satisfy dependency 'libwiretap.so=16-64' required by wireshark-qt
:: unable to satisfy dependency 'libwsutil.so=17-64' required by wireshark-qt
➜  ~ sudo downgrade wireshark-cli 
loading packages...
warning: downgrading package wireshark-cli (4.7.0-1 => 4.6.6-1)
resolving dependencies...
looking for conflicting packages...
error: failed to prepare transaction (could not satisfy dependencies)
:: installing wireshark-cli (4.6.6-1) breaks dependency 'libwireshark.so=0-64' required by wireshark-qt
:: installing wireshark-cli (4.6.6-1) breaks dependency 'libwiretap.so=0-64' required by wireshark-qt
:: installing wireshark-cli (4.6.6-1) breaks dependency 'libwsutil.so=0-64' required by wireshark-qt
➜  ~ sudo downgrade wireshark-qt 
loading packages...
warning: downgrading package wireshark-qt (4.7.0-1 => 4.6.0-1)
resolving dependencies...
warning: cannot resolve "libwireshark.so=19-64", a dependency of "wireshark-qt"
warning: cannot resolve "libwiretap.so=16-64", a dependency of "wireshark-qt"
warning: cannot resolve "libwsutil.so=17-64", a dependency of "wireshark-qt"
:: The following package cannot be upgraded due to unresolvable dependencies:
      wireshark-qt

:: Do you want to skip the above package for this upgrade? [y/N] 
error: failed to prepare transaction (could not satisfy dependencies)
:: unable to satisfy dependency 'libwireshark.so=19-64' required by wireshark-qt
:: unable to satisfy dependency 'libwiretap.so=16-64' required by wireshark-qt
:: unable to satisfy dependency 'libwsutil.so=17-64' required by wireshark-qt
➜  ~ wireshark                   
 ** (wireshark:17929) 16:19:17.487834 [Epan WARNING] /usr/src/debug/wireshark/wireshark/ui/ui_prefs.c:202 -- ui_prefs_read_pref(): Preference "language" has been converted to "ui_language.language"
Save your preferences to make this change permanent.
 ** (wireshark:17929) 16:19:17.705899 [GUI WARNING] -- Failed to register with host portal QDBusError("org.freedesktop.portal.Error.Failed", "Could not register app ID: Connection already associated with an application ID")
 ** (wireshark:17929) 16:21:34.299450 [GUI WARNING] -- This plugin supports grabbing the mouse only for popup windows
 ** (wireshark:17929) 16:21:34.981442 [GUI WARNING] -- This plugin supports grabbing the mouse only for popup windows
 ** (wireshark:17929) 16:21:35.728402 [GUI WARNING] -- This plugin supports grabbing the mouse only for popup windows
 ** (wireshark:17929 ...
(more)
edit retag flag offensive close merge delete

Comments

Can you add the output of wireshark -v. It's difficult to tell which version you ended up with in the install log.

Chuckc gravatar imageChuckc ( 2026-06-10 21:10:01 +0000 )edit

Can't use ether either as is said in man page.

If a man page claims that ether, by itself, is a valid capture filter, that man page has an error:

$ tcpdump -i en0 ether
tcpdump: link layer applied in wrong context

"ether" isn't, by itself, a valid capture filter. Do you mean something such as ether proto \ip or ether proto 0x0800 can't be used? (Yes, the backslash in ether proto \ip is necessary; ether proto ip is invalid, because ip is s special keyword in capture filters.)

Guy Harris gravatar imageGuy Harris ( 2026-06-15 19:18:49 +0000 )edit

2 Answers

Sort by » oldest newest most voted
0

answered 2026-06-15 19:38:48 +0000

Guy Harris gravatar image

updated 2026-06-16 17:43:49 +0000

As Gerald noted, no OS packaging system should be packaging 4.7.x as the current release, as it's an alpha release. I don't know to what extent that's Arch Linux's fault; I don't know by what mechanism they get indications of what the current release of Wireshark is, but whatever it is, it needs to be fixed.

I suggest you report that to the Arch Linux maintainers as a bug in their package system; it should be providing 4.6.6, NOT 4.7.0 or any other 4.7.x release.

Upgraded wireshark today now I can't use the empty filter.

That was bug #21303 "If you double-click an interface in the welcome screen interface list, and have typed nothing in the capture filter box, the system reports an invalid capture filter", which has been fixed - so that bug will not be in the official 5.0 release.

edit flag offensive delete link more
0

answered 2026-06-10 22:17:04 +0000

Gerald Combs gravatar image

Arch probably shouldn't be shipping 4.7.0, since as the release notes say "This is an experimental release intended to test new features for Wireshark 5.0." The latest stable release is 4.6.6.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2026-06-10 19:27:17 +0000

Seen: 201 times

Last updated: Jun 16