This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Coloring Rules “OK” Button Grayed Out After Update to Wireshark 2.2.0

0

Dear Wireshark,

After upgrading to Wireshark 2.2.0 from 2.0.6, I do not seem to be able to modify my Coloring Rules. Specifically, the Coloring Rules "OK" button appears to remain grayed out no matter what I do.

I completely uninstalled Wireshark, manually downloaded 2.2.0, and re-installed Wireshark 2.2.0. Nonetheless, this issue remained.

I uninstalled Wireshark 2.2.0 and re-installed Wireshark 2.0.4. In Wireshark 2.0.4 I can modify my Coloring Rules and the "OK" button works as expected. Re-installed Wireshark 2.2.0 once again, but Coloring Rules "OK" button remains grayed out.

Thank you.

asked 26 Sep '16, 06:36

jsizemore's gravatar image

jsizemore
11●1●1●4
accept rate: 0%

One Answer:

1

There was a change in v2.2 with regards to the syntax of the display filters for bad checksums. This change makes the old default "Checksum Errors" coloring rule invalid which is why it shows up as not enabled in v2.2.

But it seems that it also prevents you from clicking Ok.

To work around the problem you can delete (or correct the syntax of) the "Checksum Errors" coloring rule. The new rule should be:

eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" || edp.checksum.status=="Bad" || wlan.fcs.status=="Bad" || stt.checksum.status=="Bad"

Bug 12814 was recently opened to fix this.

answered 26 Sep '16, 12:04

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k●5●72
accept rate: 27%

I ran into the same problem, After upgrading to Wireshark 2.2.0 from 2.0.6, I do not seem to be able to modify my Coloring Rules. Specifically, the Coloring Rules "OK" button appears to remain grayed out no matter what I do.

Maybe the colorfilters file is read only? If this could be the case, what is the location of that file on Linux Debian?

Thanks you

(21 Nov '16, 12:19) toloop

(I converted your Answer to a Question--this is a Q&A site, not a forum, see the FAQ.)

Did you fix the syntax of the "Checksum Errors" coloring rule as described in the answer?

I don't think that the permissions on the colorfilters file will have an effect. That file, should you want to check on it, should be in ~/.wireshark/

(21 Nov '16, 12:47) JeffMorriss ♦