https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16541

            Bug ID: 16541
           Summary: Should protocol display filters work for all protocols
                    in frame.protocols?
           Product: Wireshark
           Version: 3.2.3
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: Minor
          Priority: Low
         Component: Dissection engine (libwireshark)
          Assignee: bugzilla-ad...@wireshark.org
          Reporter: bubbas...@gmail.com
  Target Milestone: ---

Build Information:
3.2.3 (v3.2.3-0-gf39b50865a13)

Compiled (64-bit) with Qt 5.12.6, with WinPcap SDK (WpdPack) 4.1.2, with GLib
2.52.3, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4,
with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos,
with MaxMind DB resolver, with nghttp2 1.39.2, with brotli, with LZ4, with
Zstandard, with Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic
updates using WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled
resampler), with SBC, with SpanDSP, with bcg729.

Running on 64-bit Windows 10 (1903), build 18362, with Intel(R) Core(TM)
i5-4300U CPU @ 1.90GHz (with SSE4.2), with 12193 MB of physical memory, with
locale English_United States.1252, with light display mode, without HiDPI, with
Npcap version 0.9988, based on libpcap version 1.9.1, with GnuTLS 3.6.3, with
Gcrypt 1.8.3, with brotli 1.0.2, without AirPcap, binary plugins supported (19
loaded).

Built using Microsoft Visual Studio 2019 (VC++ 14.24, build 28316).

--
As an example
  https://wiki.wireshark.org/SampleCaptures#OpenFlow
  openflow_v1.3_messages.pcapng.gz
but applies to many other protocols.

[Protocols in frame: eth:ethertype:ip:tcp:openflow:openflow_v4]

A display filter of "openflow" or display filter of "ethertype" don't match any
packets.

Display filters such as these do produce a packet list:
   frame.protocols contains "openflow"
   frame.protocols contains "ethertype"

A bug? Working as designed? Working as implemented?

-- 
You are receiving this mail because:
You are watching all bug changes.
___________________________________________________________________________
Sent via:    Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives:    https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
             mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

Reply via email to