Wireshark-dev: Re: [Wireshark-dev] FT_TYPE appropiated?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 17 Mar 2016 01:54:15 -0700
On Mar 16, 2016, at 10:14 AM, Juan Jose Martin Carrascosa <juanjo@xxxxxxx> wrote:

> I have a field that has the following content (hex bytes):
> 
> 0a00020f00007cfb00000001
> 
> If I use FT_STRING, it displays 0a\n. Thus, I decided to use FT_BYTES. 
> 
> The problem now is that when I do right-click -> Apply as column, if I do right-click in the column and do "apply as filter" or "prepare a filter", it interprets the content as FT_STRING.

That's not what I see - it doesn't put the value in quotes.

What it's doing is, for any custom column for a field that's not an FT_STRING, putting the raw value of the column text into the filter expression, which is *not* what should be done, as the raw value of the column text might, for example, be truncated or might have some other issue that renders it unusable in a filter expression.

It should be using construct_match_selected_string() to construct the filter for a custom column, just as is done if you select the field in the packet details pane.

Yes, you should file a bug on this, so that this can be recorded and tracked.