This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Where are the capture-filter options in Wireshark 1.8.0?

2
1

I just installed 1.8.0, and the capture filter is missing. I checked this on a Windows 7 and a Windows XP PC. Is this a bug?

alt text

asked 05 Jul '12, 03:17

meneerB's gravatar image

meneerB
31125
accept rate: 0%

edited 07 Jul '12, 22:30

helloworld's gravatar image

helloworld
3.1k42041


2 Answers:

7

In the interface list: scroll to the right and you will see a column called "Capture Filter". Double click an interface to specify the capture filter for that interface. Since 1.7 it is possible to capture on multiple interfaces in parallel, hence each interface has it's own capture filter.

Regards
Kurt

answered 05 Jul '12, 03:33

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

ah! How could I miss that:-) Thanks Kurt.

(05 Jul '12, 05:46) meneerB
3

Wow. That is very non-intuitive. So we took an often used feature and placed it behind a double-click UI. Double clicking on configuration option pages is extremely uncommon across any application. And the only clue left in wireshark is the right-most table column that may require horizontal scrolling to view. That sucks.

(25 Jul '12, 09:11) Gabe
1

That sucks.

If you have an idea how to do it better, you are welcome to post it here or at http://bugs.wireshark.org

You can also submit a patch that shows how to do it better.

Volunteers are welcome to participate and to make Wireshark a better tool.

(25 Jul '12, 09:17) Kurt Knochner ♦
1

Perhaps making the default size of the window big enough to see the capture filter column would do the trick. If I had seen that I would have stumbled on the "double-click the interface to configure" trick. I like the new capture filter dialog box, though--that will save me typing since I never bothered to save my bpf filters in files. thanks john

(03 Aug '12, 08:28) John52

Here's an idea, @Kurt: Put the old global capture filter field back. If someone types something into it, it overrides any per-interface filter. If someone wants per-interface filtering, they can scroll and double-click; they've chosen to do something uncommon, so they can deal with the pain of extra UI impedance. @Gabe's 100% right: you've moved a common operation behind additional UI layers. Please un-hide it.

(02 Sep '12, 15:10) Warren Young

Or just put the capturefilter column in the second left. Is it simple? :-) I spent much time to find the missing option as well until I saw the anster from @Kurt .

(03 Sep '12, 18:40) cnadl

I had exactly the same problem finding the capture filter. Thanks for the info, stopped me going insane looking for it!

(16 Nov '12, 04:47) rrgmitchell
1

IMO, even just one line of text "double click an interface to specify an interface specific filter" just below the scrollable list of interfaces (where we are all used to specifying the filter before) would be awesome. It is not a really big deal, but there are a lot of us who were confused, think the feature is gone, and have to google/search around for a post like this to set us straight. The global filter is a great idea, too, though, because some people may actually like being able to capture from several interfaces at once with the same filter, rather than having to specify the same filter multiple times. Kudos, getting better all the time!

(07 Jan '13, 14:26) bbct

For what it's worth, you can just double click on the interface. You don't have to scroll over to the right, and double click on the "Capture Filter" syntax. Again, this was to support simultaneous capture requirement so it makes sense. I agree that it may not as straight forward the first time you have to do it.

(07 Jan '13, 20:49) hansangb

thanks Kurt!

(22 Feb '13, 12:10) kaimuki

OK, having separate filters makes sense. Having to guess that if you activate the row you'll get a filter dialog, makes somewhat less sense. My idea to do it better? make the content of the cell in the filter column a button. Or make the "no filter is defined" state display "double-click here to set a filter on this interface" instead of emptiness.

(04 Mar '13, 08:42) Mark Wood
showing 5 of 11 show 6 more comments

4

Changes have been made to the development version to add a global capture filter field. Note that according to the Wireshark release policy this is unlikely to go out into a 1.8.x release as only bugfixes are backported. You'll have to wait for 1.10, or use a development automated build of 1.9.x or compile from development sources:

answered 04 Sep '12, 02:20

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 04 Mar '13, 08:56

Thank you!

(04 Sep '12, 03:09) Warren Young

I just tested the latest 1.9.0 svn build. The new UI is exactly what I wanted. Thanks!

(02 Nov '12, 19:58) Warren Young