Bug 747177

Summary: wireshark hangs when I try to enter "host <whatever>" capture filter
Product: [Fedora] Fedora Reporter: Jonathan Kamens <jik>
Component: wiresharkAssignee: Radek Vokál <rvokal>
Status: CLOSED WORKSFORME QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 16CC: huzaifas, jsafrane, rvokal
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 868058 (view as bug list) Environment:
Last Closed: 2011-11-04 13:54:30 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 868058    
Attachments:
Description Flags
video of hang none

Description Jonathan Kamens 2011-10-19 02:39:44 UTC
Created attachment 528914 [details]
video of hang

With up-to-date F16 beta:

1. Run wireshark.
2. Select Capture | Options...
3. Select your external network interface.
4. Click in the "Capture Filter:" text box and try to type "host <whatever>", where <whatever> is the host you want to filter on.
5. The text box turns red after you type "host " and then wireshark hangs and you have to kill it.

Video of this sequence is attached.

Comment 1 Jan Safranek 2011-11-04 13:45:01 UTC
It works for me with wireshark-1.6.2-4.fc16.x86_64. Wireshark interactively as you type checks, if 'host whatever' is valid filter, i.e. if 'whatever' can be resolved to IP address. This is usually quick enough so you don't notice it, but if your DNS is in bad shape or down at the moment, it might take some time for wireshark to give up trying.

So, was there something wrong with your DNS? And you might also hit bug #747377, please update your Wireshark to latest version and try again.

Comment 2 Jonathan Kamens 2011-11-04 13:54:30 UTC
This was not a DNS issue, it was a hard hang. I never even got to the point of being able to type the host name after I typed "host ". As soon as I typed "host " in the field field, wireshark hung and nothing I did unhung it.

Having said that, you're correct that it appears to be working now with current stuff from F16, so it appears that whatever was broken is now fixed.