Riverbed Cascade Pilot Personal Edition: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Wireshark-users: [Wireshark-users] Filtering SCTP message contents

Date Index Thread Index Other Months All Mailing Lists

Date Prev Date Next Thread Prev Thread Next

From: Emre UZUNCA <euzunca@xxxxxxxxx>
Date: Wed, 3 Sep 2008 23:42:13 -0700 (PDT)

Hi,

When bundling is used for SCTP messages, filter conditions are checked in the full SCTP message content. For example, if 2 M3UA messages are bundled in a single SCTP message, the filter specifed as (m3ua.protocol_data_opc == 10000) && (m3ua.protocol_data_dpc== 10001) is satisfied when the first M3UA message has m3ua.protocol_data_opc == 10000 and the second has m3ua.protocol_data_dpc== 10001. Is there a way to make the filter check only the same M3UA message contents?

Thanks,

Emre

Follow-Ups:
- Re: [Wireshark-users] Filtering SCTP message contents
  - From: Guy Harris

Prev by Date: Re: [Wireshark-users] Problem running Wireshark on Mac OS X Leopard 10.5.2
Next by Date: Re: [Wireshark-users] Filtering SCTP message contents
Previous by thread: Re: [Wireshark-users] Problem running Wireshark on Mac OS X Leopard 10.5.2
Next by thread: Re: [Wireshark-users] Filtering SCTP message contents
Index(es):
- Date
- Thread