![]() I'd not object against the field to be red as well, but it'd have to be red already before the user starts to type in. ![]() So instead of the red background appearing as late as when the user actually types into the field, I'd expect another explanatory text, asking to choose an interface first, to be shown in the capture filter field, locked against editing, until an interface is chosen. This behaviour is a proof that doing it in a user-friendly way is possible. Showing a valid syntax in red is really confusing and doesn't give the user a clue what is actually wrong.Įspecially as there is just a single capture filter field whose contents changes depending on which interface is chosen, and if you choose several interfaces and each of them has a different capture filter setting, an explanatory text occurs in the capture filter field. For general help using display filters, please see the wireshark-filter manual page or the User's Guide. They let you drill down to the exact traffic you want to see and are the basis of many of Wireshark's other features, such as the coloring rules. ![]() Aragon, I've withdrawn my answer that the behaviour you describe is a bug, but I still find it counter-intuitive. Wireshark's most powerful feature is its vast array of display filters (over 271000 fields in 3000 protocols as of version 3.6.8).
0 Comments
Leave a Reply. |