Wireshark-users: Re: [Wireshark-users] How to "unsort"

From: Lee <ler762@xxxxxxxxx>
Date: Wed, 16 Mar 2016 13:01:39 -0400
On 3/15/16, Guy Harris <guy@xxxxxxxxxxxx> wrote:
> On Mar 15, 2016, at 5:15 PM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:
>
>> On Tue, Mar 15, 2016 at 1:23 PM, Perry Smith <pedzsan@xxxxxxxxx> wrote:
>>> I’m using Wireshark 2.0.1 on a Mac.  I really enjoy the new UI.
>>>
>>> I click on a column to sort the output by that column.  Is there a way to
>>> undo this?
>>>
>>> I know I can click on “No.” but that appears to be slightly different.
>>> Any adjustment now makes a second pass ‘sorting by No.’ whereas before it
>>> did not need the second pass.
>>
>> That's the right way to do it.  When you haven't sorted on any particular
>> column then the display is sorted by the (Frame) Number column.  By
>> sorting by that column again you should be returning to the initial state.
>>
>> What do you mean when you say "any adjustment" leads to a "sorting by"
>> pass?  What kind of adjustment?
>
> Changing a protocol preference, for example.  (Reproduced on a Very Large
> Capture I have.)

I get the same behavior on windows using wireshark 2.0.2

Open a 25MB pcapng file and click on
Analyze / enable protocols
add or remove the checkmark for 3COMXNS
click OK

and the status msg at the bottom of the screen says
Rescanning:

Click on any column heading, then click on the No. heading (frame number?)
Analyze / enable protocols
add or remove the checkmark for 3COMXNS
click OK

and the status msg at the bottom of the screen says
rescanning:
dissecting:
sorting:

Lee