I 'ignored' packet 915 as it is setting off wireshark's dns.time calculation using right-click - Ignore (CTL-D) How do I get the ignored packet back in to the display without closing and opening the trace file again?
asked 29 Jul '16, 12:43  mrEEde |
2 Answers:
In your screen shot, you have applied a display filter of "dns.id==0x352c". When a packet is ignored, it is no longer dissected and effectively has no attributes, therefore it will not match your display filter (no matter what the display filter is). So when you ignore a packet with a display filter in place, it drops out of the display. The next displayed packet becomes the selected packet, so that's the packet that Ctrl-D now operates on. You need to clear the display filter so that the ignored packet becomes visible again and can be selected. Then you can toggle the ignored status using Ctrl-D or right-click and then Ignore/Unignore Packet. answered 30 Jul '16, 07:30  Jim Aragon |
Use answered 29 Jul '16, 12:45  cmaynard ♦♦ unfortunately not, CTL_D ignores the next selected packet . I' using the latest code - currently 2.3.0-119 (29 Jul '16, 12:50) mrEEde Then that would appear to be a bug. I would suggest filing a bug report. (29 Jul '16, 12:58) cmaynard ♦♦ By the way, is it that only the (29 Jul '16, 13:26) cmaynard ♦♦ As the ignored packet wasn't visible when the filter was applied the Edit menue path to un-ignore didn't work either (30 Jul '16, 22:45) mrEEde |
That was it! When I remove the filter the ignored packet appears and can be unignored!
Thanks