Wireshark-users: [Wireshark-users] Display filters for application protocols
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Lukáš Oliva <olivalukas@xxxxxxxxx>
Date: Tue, 8 Mar 2011 15:22:15 +0100
  Hello to the community,
I am doing some testing for the Diameter protocol and I noticed
interesting behaviour of the display filters. I noticed that if I run

tshark -r mypcap.pcap -R "diameter.cmd.code==302"

then the output contains afterwards also Diameter packets with
different diameter.cmd.code. I am not sure if it is actually a bug and
how tshark handles this filtering for application protocols.
E.g.: If there is a packet on containing more Diameter (or other
application protocol) messages on IP (or possibly TCP) level, how is
this will the display filter filter all of them?

Just for the illustration:

1  TCP packet: Diameter message 1 (LIR), Diameter message 2 (MAR),
Diameter message 3 (SAR)

Running tshark -r mypcap.pcap -R "diameter.cmd.code==302" ... # so
filtering out the LIR messages which have message code 302

Should the tshark produce a list of LIR messages only?

  Warm regards
  Lukas