This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Dear Wireshark,

After upgrading to Wireshark 2.2.0 from 2.0.6, I do not seem to be able to modify my Coloring Rules. Specifically, the Coloring Rules "OK" button appears to remain grayed out no matter what I do.

I completely uninstalled Wireshark, manually downloaded 2.2.0, and re-installed Wireshark 2.2.0. Nonetheless, this issue remained.

I uninstalled Wireshark 2.2.0 and re-installed Wireshark 2.0.4. In Wireshark 2.0.4 I can modify my Coloring Rules and the "OK" button works as expected. Re-installed Wireshark 2.2.0 once again, but Coloring Rules "OK" button remains grayed out.

Thank you.

asked 26 Sep '16, 06:36

jsizemore's gravatar image

jsizemore
11114
accept rate: 0%


There was a change in v2.2 with regards to the syntax of the display filters for bad checksums. This change makes the old default "Checksum Errors" coloring rule invalid which is why it shows up as not enabled in v2.2.

But it seems that it also prevents you from clicking Ok.

To work around the problem you can delete (or correct the syntax of) the "Checksum Errors" coloring rule. The new rule should be:

eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" || edp.checksum.status=="Bad" || wlan.fcs.status=="Bad" || stt.checksum.status=="Bad"

Bug 12814 was recently opened to fix this.

permanent link

answered 26 Sep '16, 12:04

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

I ran into the same problem, After upgrading to Wireshark 2.2.0 from 2.0.6, I do not seem to be able to modify my Coloring Rules. Specifically, the Coloring Rules "OK" button appears to remain grayed out no matter what I do.

Maybe the colorfilters file is read only? If this could be the case, what is the location of that file on Linux Debian?

Thanks you

(21 Nov '16, 12:19) toloop

(I converted your Answer to a Question--this is a Q&A site, not a forum, see the FAQ.)

Did you fix the syntax of the "Checksum Errors" coloring rule as described in the answer?

I don't think that the permissions on the colorfilters file will have an effect. That file, should you want to check on it, should be in ~/.wireshark/

(21 Nov '16, 12:47) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×18
×18
×17
×1

question asked: 26 Sep '16, 06:36

question was seen: 1,295 times

last updated: 21 Nov '16, 12:47

p​o​w​e​r​e​d by O​S​Q​A