Hello, I tried to use Wireshark to capture traffic to a certain website (on Windows). It is very hard to edit filter expression in the top bar after you enter it. For example, arrows key don't work at all, same with Home and End keys. Using any of those results in losing input focus. Basically, if I want to change a typo I have to delete the whole thing and type everything again (or copy & paste). Am I doing something wrong or it's a bug? I'm new to Wireshark, I used an HTTP proxy before all this (Fiddler) but I needed to inspect traffic for an app that doesn't honor system proxy settings :/ asked 02 Jan '17, 23:49  wiredude edited 02 Jan '17, 23:52 |
One Answer:
(Just to provide an answer.) This sounds like bug 11890. answered 03 Jan '17, 06:56  JeffMorriss ♦ That smells like it. Thanks for looking it up - it was not annoying enough to chase it down. (03 Jan '17, 07:53) Bob Jones No problem - I like helping to avoid duplicate bug reports when I can (not that I've had time to look at the bugs database in a while...). And I like questions with answers. :-) (03 Jan '17, 10:33) JeffMorriss ♦ |
Are you editing the filter after capture is stopped, or is it still running?
I can reproduce this too on the Qt version, but not on legacy GTK. I'm relatively current with version 2.2.3 but have seen this for quite a while. It happens often, but I do not know the exact sequence to get in this state. Recovery is usually to delete the entry and start over.
I'm editing while capture is running. I'm using the latest version of Wireshark on Windows 10. I've also just checked on Ubuntu and it's happening there too, with Wireshark 2.2.0.
When capture is stopped I can edit filter text without problems. I guess it's a bug then.