"dfilter" file on Windows adds carriage returns, and requires line feeds
After creating a display filter bookmark in Windows, the related dfilters file will separate each line with two carriage returns and a line feed. The carriage returns seem to be irrelevant. Line feeds seem to be what is required to separate bookmarks. In windows when using Notepad to edit the file, any filters separated by simply using carriage returns will all end up on one line.
Steps to reproduce (in Windows)
- Create a bookmark to create a dfilters file in the current profile.
- Open the dfilters file in notepad. You will immediately notice a blank line between each filter due to the two carriage returns.
- If you add any filters to the end of the file, or paste any in, Notepad/wordpad/or most editors will not add a linefeed character to the end of the line. Save the file
- Restart Wireshark, choose the profile, check the bookmarks. Any filters created with carriage return separations only will all display on a single line.
What is the current bug behavior?
If you do the same process in Linux, it will use line feeds instead. Thus, no problem. Those edited dfilters will work fine in Windows. Or, if you use a program like Notepad++ to insert LF instead of CR then it will work smoothly.
What is the expected correct behavior?
If the filter file was created with LF only then it would appear that Notepad (and probably others) would adopt that for an end of line providing full editing functionality on Windows. It would probably not require a blank line in between. Either that or adopt an end of line to be a CR and/or a LF. That thought is made of course from a user standpoint and not a programmer standpoint not knowing if it would require moving heaven and earth to do so. ;-)
3.6.5 (v3.6.5-0-g21f79ddbefbd) Compiled (64-bit) using Microsoft Visual Studio 2019 (VC++ 14.31, build 31107), with Qt 5.15.2, with libpcap, with GLib 2.66.4, with zlib 1.2.11, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.44.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.10, with libsmi 0.4.8, with QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled resampler), with Minizip. Running on 64-bit Windows 10 (1903), build 18362, with AMD EPYC 7452 32-Core Processor (with SSE4.2), with 4095 MB of physical memory, with GLib 2.66.4, with Qt 5.15.2, with Npcap version 1.55, based on libpcap version 1.10.2-PRE-GIT, with c-ares 1.17.0, with GnuTLS 3.6.3, with Gcrypt 1.8.3, with nghttp2 1.44.0, with brotli 1.0.9, with LZ4 1.9.3, with Zstandard 1.4.0, without AirPcap, with light display mode, without HiDPI, with LC_TYPE=English_United States.utf8, binary plugins supported (21 loaded).