Wireshark · Ethereal-users: Re: [Ethereal-users] ethereal display filters are not working

[Guy Harris <gharris@xxxxxxxxx>]

Sudhanshu Gupta wrote:

> I created a regular file in a NFS mounted file system. I found out the
> inode no of this newly created file. I have caputred the nfs packets
> for this creat request with tpdump.

When you captured them, did you use the flag "-s 65535" or, with newer 
versions of tcpdump, "-s 0"?

If not, only the first 68 or 96 bytes of the packet will be captured, 
which is probably not enough to capture the bytes of the packet 
containing the file handle.  If the file handle isn't in the packet, a 
display filter that checks the file handle won't match anything.