I just installed 1.8.0, and the capture filter is missing. I checked this on a Windows 7 and a Windows XP PC. Is this a bug?
asked 05 Jul '12, 03:17  meneerB edited 07 Jul '12, 22:30  helloworld |
2 Answers:
In the interface list: scroll to the right and you will see a column called "Capture Filter". Double click an interface to specify the capture filter for that interface. Since 1.7 it is possible to capture on multiple interfaces in parallel, hence each interface has it's own capture filter. Regards answered 05 Jul '12, 03:33  Kurt Knochner ♦ showing 5 of 11 show 6 more comments |
Changes have been made to the development version to add a global capture filter field. Note that according to the Wireshark release policy this is unlikely to go out into a 1.8.x release as only bugfixes are backported. You'll have to wait for 1.10, or use a development automated build of 1.9.x or compile from development sources: answered 04 Sep '12, 02:20  grahamb ♦ edited 04 Mar '13, 08:56 Thank you! (04 Sep '12, 03:09) Warren Young I just tested the latest 1.9.0 svn build. The new UI is exactly what I wanted. Thanks! (02 Nov '12, 19:58) Warren Young |
ah! How could I miss that:-) Thanks Kurt.
Wow. That is very non-intuitive. So we took an often used feature and placed it behind a double-click UI. Double clicking on configuration option pages is extremely uncommon across any application. And the only clue left in wireshark is the right-most table column that may require horizontal scrolling to view. That sucks.
If you have an idea how to do it better, you are welcome to post it here or at http://bugs.wireshark.org
You can also submit a patch that shows how to do it better.
Volunteers are welcome to participate and to make Wireshark a better tool.
Perhaps making the default size of the window big enough to see the capture filter column would do the trick. If I had seen that I would have stumbled on the "double-click the interface to configure" trick. I like the new capture filter dialog box, though--that will save me typing since I never bothered to save my bpf filters in files. thanks john
Here's an idea, @Kurt: Put the old global capture filter field back. If someone types something into it, it overrides any per-interface filter. If someone wants per-interface filtering, they can scroll and double-click; they've chosen to do something uncommon, so they can deal with the pain of extra UI impedance. @Gabe's 100% right: you've moved a common operation behind additional UI layers. Please un-hide it.
Or just put the capturefilter column in the second left. Is it simple? :-) I spent much time to find the missing option as well until I saw the anster from @Kurt .
I had exactly the same problem finding the capture filter. Thanks for the info, stopped me going insane looking for it!
IMO, even just one line of text "double click an interface to specify an interface specific filter" just below the scrollable list of interfaces (where we are all used to specifying the filter before) would be awesome. It is not a really big deal, but there are a lot of us who were confused, think the feature is gone, and have to google/search around for a post like this to set us straight. The global filter is a great idea, too, though, because some people may actually like being able to capture from several interfaces at once with the same filter, rather than having to specify the same filter multiple times. Kudos, getting better all the time!
For what it's worth, you can just double click on the interface. You don't have to scroll over to the right, and double click on the "Capture Filter" syntax. Again, this was to support simultaneous capture requirement so it makes sense. I agree that it may not as straight forward the first time you have to do it.
thanks Kurt!
OK, having separate filters makes sense. Having to guess that if you activate the row you'll get a filter dialog, makes somewhat less sense. My idea to do it better? make the content of the cell in the filter column a button. Or make the "no filter is defined" state display "double-click here to set a filter on this interface" instead of emptiness.