Comment # 5
on bug 11836
from Guy Harris
(In reply to VC from comment #4)
> I'm able to enter the filter directly in the box, although, the filter stays
> red if no interface is selected, and it turns green as soon as I select an
> interface.
Without knowing on which interfaces the capture will be done, it's impossible
to determine whether the capture filter is valid or not - the way it's
determined is by trying to compile it with libpcap/WinPcap, and that requires a
link-layer header type.
We could disable the checking if no interface is selected, so that the box is
neither red nor green.
(Doing better would either require duplicating the libpcap/WinPcap parsing
code, which runs the risk of Wireshark's parser not being the same as the
parser in the version of libpcap/WinPcap you're using - and, yes, new features
have been added to the capture filter language over time, so the version of
libpcap/WinPcap matters - or adding to libpcap and WinPcap the ability to parse
without generating BPF code and disabling any "this only works with this
link-layer header type" checks.)
You are receiving this mail because:
- You are watching all bug changes.