Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: [Wireshark-users] Problems locating relevant calls

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: <kevin_duffy@xxxxxxxxxxx>
Date: Wed, 4 Oct 2006 15:48:02 +0100

Wireshark Version “0.99.3”

 

1) In the main “Packet List” window, I can see the messages of interest that I would like to extract.

 

I’m monitoring MGCP traffic, so I’d like to extract the call that these message appear in.

 

I’ve made use of the “VoIP Calls” feature, but I cannot associate the messages I’m interested in with the calls they belong to.

 

I’ve tried using the message timestamps as a reference point, but still cannot easily find the calls containing those messages.

 

How can I achieve this goal using available filtering features?

 

I’ve tried EndPoint filtering, but this only matches parts of the calls. Some call messages don’t contain anything more than a transaction id ie. “200 OK”

 

 

2) I did manage to locate a call containing the message of interest, but the call was 112 messages long. I cannot build a filter to isolate all 112 messages (Complete call). The current limitation seems between 80 and 90 messages.

 

Is there an option I can tweak, or is this a known limitation that will be fixed?

 

 

Kevin Duffy

Solutions Test Engineer

Assurance Solutions Division

Agilent Technologies UK Limited

 

  • Prev by Date: [Wireshark-users] RE : Export as PDML bug corrected in the nightlies, but ...
  • Next by Date: [Wireshark-users] Question about parsing raw MTP3
  • Previous by thread: [Wireshark-users] RE : Export as PDML bug corrected in the nightlies, but ...
  • Next by thread: [Wireshark-users] Question about parsing raw MTP3
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation