I recently found myself in need of wireshark while doing some experiments with a virtual machine . After starting and updating my existing Debian 9 VM with wireshark installed, I found I had a bit of a display issue. As you can see in the below screenshot, parts of wireshark’s GTK interface were not rendering (in particular the text box for entering filter strings). I also found that menus within the XFCE terminal weren’t displaying correctly, lacking any padding on both the menus and the menu bar.
Looking at existing solutions I found there were a couple of points that came up repeatedly:
- In many reported cases the issue was isolated to a single user account, I found my issue was present across users.
This did not however stop me from deleting my xfce settings folder (~/.config/xfce). - There was lots of discussion of gtk3 and changes within gtk3 causing issues with themes. [example 1, example 2, example 3]
I was able to confirm that switching to a theme without xfce in the name, for example, Adwaita, resolved the issue.
I found that setting up a new system, also with xfce and the gtk interface for wireshark, didn’t cause a similar issue. While I considered deleting the old VM and using this new one, I had at this point become highly interested in finding out what was happening with my current VM.
At this point I did, however, have solution one (pictured below), use a different theme. Additionally, I knew it was something on this particular system that was causing the problem with the default theme, and continued my attempt to find out what.
Based on the above I started comparing non-user specific settings and files between my two systems, eventually landing in the directory for the theme, /usr/share/themes/Xfce. On the problem system there were two directories here, gtk-3.0 and gtk-2.0 (left screenshot below). On the working system there was only one directly gtk-2.0 (right screenshot below). Initially I put this discovery and point 2 from the above finding list together and deleted the gtk-3.0 directory. After a restart (probably overkill) I had a correctly functional, likely to be confused later system. I also had a lightbulb moment memory of there being a couple of xfce packages that had references to gtk2 and gtk3 in the name.
After some digging I found that my problem system had the gtk3-engines-xfce package installed, while my working system did not. On my system no other installed packages depended on this package, so apt-get purge gtk3-engines-xfce (as shown in header image) resulted in solution two to this problem (shown below).
Once I knew the problem package, it was a fairly direct path to Debian bug #762936, which appears to describe the issue I experienced.
As a final note, if you are only looking to fix wireshark, you might want to consider switching over to the Qt based interface (which is now the default when installing the wireshark meta-package) as we’ve now seen the last release to support the GTK interface.
