Re: tshark filter

[Guy Harris <guy () alum mit edu>]

On Oct 18, 2010, at 9:47 AM, David Milbourne wrote:

> That shows me all the successful and unsuccessful logins.  Is there an easy way of filtering out all the unsuccessful 
> logins so I don't see all the password guessing attempts?

Unfortunately, no; the FTP dissector doesn't associate requests and responses (or even associate a USER request and the 
following PASS request), so you can't specify a filter that selects only requests that have successful responses.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe