Wireshark mailing list archives
Re: Display filters for application protocols
From: Chris Maynard <chris.maynard () gtech com>
Date: Tue, 8 Mar 2011 15:28:56 +0000 (UTC)
Lukáš Oliva <olivalukas@...> writes:
I am doing some testing for the Diameter protocol and I noticed interesting behaviour of the display filters. I noticed that if I run tshark -r mypcap.pcap -R "diameter.cmd.code==302" then the output contains afterwards also Diameter packets with different diameter.cmd.code. I am not sure if it is actually a bug and how tshark handles this filtering for application protocols.
Maybe you could post a [small] capture file that depicts the problem? ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Display filters for application protocols Lukáš Oliva (Mar 08)
- Re: Display filters for application protocols Chris Maynard (Mar 08)
- Re: Display filters for application protocols Jeff Morriss (Mar 08)
- Re: Display filters for application protocols Lukáš Oliva (Mar 08)
- Re: Display filters for application protocols Jeff Morriss (Mar 08)
- Re: Display filters for application protocols Stephen Fisher (Mar 08)
- Re: Display filters for application protocols Lukáš Oliva (Mar 08)
- Re: Display filters for application protocols Lukáš Oliva (Mar 08)
- Re: Display filters for application protocols Guy Harris (Mar 08)
- Re: Display filters for application protocols Sake Blok (Mar 08)
- Re: Display filters for application protocols Guy Harris (Mar 08)
- Re: Display filters for application protocols Sake Blok (Mar 08)
- Re: Display filters for application protocols Lukáš Oliva (Mar 08)