This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Location of Filter expression on Mac OS

0

Where is the filter expression file located? The reason i ask is when I perform an uninstall my original filter expression remain.

asked 04 Apr '15, 15:30

mewireshark's gravatar image

mewireshark
6336
accept rate: 0%

Which filter expressions? Color filters? Saved display filters?

(04 Apr '15, 19:17) Guy Harris ♦♦

The filter expression found under edit-filter-preference.Also found on the first button right of the save button.

(06 Apr '15, 02:21) mewireshark

sounds like a duplicate to this question: https://ask.wireshark.org/questions/41038/mac-os-filter-removal

(06 Apr '15, 03:05) Kurt Knochner ♦

One Answer:

0

under edit-filter-preference

Presumably you mean "under Edit -> Preferences when you click on Filter Expressions".

Those are stored in ~/.wireshark/preferences; look for the heading

####### Filter Expressions ########

and the gui.filter_expressions items under it.

That's a personal file, not a system file, so it should not be surprising that uninstalling doesn't remove it. Uninstalling applications of any sort, not just Wireshark, tends not to uninstall personal configuration files.

answered 06 Apr '15, 10:34

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%