New Qt UI lacks ability to step through multiple TCP streams with Analyze > Follow > TCP Stream

This issue was migrated from bug 11987 in our old bug tracker.

Original bug information:

Reporter: Warren Young
Status: RESOLVED FIXED
Product: Wireshark
Component: Qt UI
OS: OS X 10.10
Platform: x86-64
Version: 2.0.1

Warren Young said:

Build Information: Version 2.0.1 (v2.0.1-0-g59ea380c from master-2.0)

Copyright 1998-2015 Gerald Combs <gerald@‍wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.3.2, with libpcap, without POSIX capabilities, with libz 1.2.5, with GLib 2.36.0, with SMI 0.4.8, without c-ares, without ADNS, with Lua 5.2, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP, with QtMultimedia, without AirPcap.

Running on Mac OS X 10.10.5, build 14F1509 (Darwin 14.5.0), with locale C, with libpcap version 1.5.3 - Apple version 47, with libz 1.2.5, with GnuTLS 2.12.19, with Gcrypt 1.5.0. Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz (with SSE4.2)

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.9.00).

When you opened a packet capture file in the old Gtk UI version of Wireshark that had multiple TCP streams in it, clicking "Filter Out This Stream" would append something like "&& !(tcp.stream eq 2)" to the filter bar if a filter was already present. The new Qt UI equivalent, "Hide this stream" overwrites this text instead, so that previously filtered streams reappear.

The prior behavior would let you step through the streams one at a time. The new behavior effectively bounces you back and forth between streams 0 and 1, since hiding stream 1 makes the first line in the packet list the first received packet again.

As an addition to this bug report, I'd like to request a related UI feature: from the "Follow TCP Stream" window, it would be nice if you could just click a "Next stream" button which would automatically hide the current stream and re-execute "Follow TCP Stream" on the next available packet.

The use case for this is with protocols like the old HTTP/1.0 protocol, where each client/server transaction is a separate TCP connection. (I'm not dealing with HTTP/1.0 specifically, just giving it as a well-known example.)

added osmacos uiqt version2.0 labels

Alexis La Goutte said:

(In reply to Warren Young from comment #0)  
> Build Information:  
> Version 2.0.1 (v2.0.1-0-g59ea380 from master-2.0)  
>  
> Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.  
> License GPLv2+: GNU GPL version 2 or later  
> <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>  
> This is free software; see the source for copying conditions. There is NO  
> warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
>  
> Compiled (64-bit) with Qt 5.3.2, with libpcap, without POSIX capabilities,  
> with  
> libz 1.2.5, with GLib 2.36.0, with SMI 0.4.8, without c-ares, without ADNS,  
> with  
> Lua 5.2, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with  
> GeoIP,  
> with QtMultimedia, without AirPcap.  
>  
> Running on Mac OS X 10.10.5, build 14F1509 (Darwin 14.5.0), with locale C,  
> with  
> libpcap version 1.5.3 - Apple version 47, with libz 1.2.5, with GnuTLS  
> 2.12.19,  
> with Gcrypt 1.5.0.  
>         Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz (with SSE4.2)  
>  
> Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build  
> 2336.9.00).  
> --  
> When you opened a packet capture file in the old Gtk UI version of Wireshark  
> that had multiple TCP streams in it, clicking "Filter Out This Stream" would  
> append something like "&& !(tcp.stream eq 2)" to the filter bar if a filter  
> was already present. The new Qt UI equivalent, "Hide this stream" overwrites  
> this text instead, so that previously filtered streams reappear.  
>  
> The prior behavior would let you step through the streams one at a time. The  
> new behavior effectively bounces you back and forth between streams 0 and 1,  
> since hiding stream 1 makes the first line in the packet list the first  
> received packet again.  

It is a bug Wireshark Qt because there is the code for append the filter but don't work (need to look why...)


>  
> As an addition to this bug report, I'd like to request a related UI feature:  
> from the "Follow TCP Stream" window, it would be nice if you could just  
> click a "Next stream" button which would automatically hide the current  
> stream and re-execute "Follow TCP Stream" on the next available packet.  
>  
> The use case for this is with protocols like the old HTTP/1.0 protocol,  
> where each client/server transaction is a separate TCP connection. (I'm not  
> dealing with HTTP/1.0 specifically, just giving it as a well-known example.)  

You can switch between "TCP Stream" with Spinbox on right ?

Gerrit Code Review said:

Change 13222 had a related patch set uploaded by Michael Mann: Use current selection of combo box when getting display filter.

https://code.wireshark.org/review/13222

Gerrit Code Review said:

Change 13222 merged by Michael Mann: Use current text of combo box when getting display filter.

https://code.wireshark.org/review/13222

closed