Hi Ariel,
No particular filter is required. When you apply a filter to a GTP
capture, that filter will try to match transport IP for GTP, and also
encapsulated IP inside GTP.
For instance, if you filter out by using "ip.addr==10.1.1.1" then WS
will apply the filter to transport IP (lowest IP layer) and also to
transported IP (upper layer):
UDP/TCP
-------
IP <----- Filter tries to match "10.1.1.1" here
-------
GTP
-------
UDP
-------
IP <----- Filter tries to match "10.1.1.1" here too
BR,
Juan
>-----Original Message-----
>From: ext Ariel Burbaickij [mailto:ariel.burbaickij@xxxxxxxxx]
>Sent: Saturday, November 22, 2008 8:51 AM
>To: Community support list for Wireshark; Wortley, Juan (NSN -
>AR/Cordoba)
>Subject: Re: [Wireshark-users] transparent GTP-'detunneling'
>in wireshark
>
>Sorry, for late response, Juan,
>I did not quite get what filter do you mean hat can be applied
>in the latest version of WS?
>
>
>/wbr
>Ariel Burbaickij
>
>
>On Sun, Oct 19, 2008 at 10:36 PM, Wortley, Juan (NSN -
>AR/Cordoba) <juan.wortley@xxxxxxx> wrote:
>> Hi,
>> At least with latests versions of WS when you apply a filter it
>> matches the criteria with "external" (GTP) and "internal"
>> (encapsulated) protocols.
>> BR,
>> Juan
>>
>>>-----Original Message-----
>>>From: wireshark-users-bounces@xxxxxxxxxxxxx
>>>[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of
>ext Ariel
>>>Burbaickij
>>>Sent: Friday, October 17, 2008 9:40 AM
>>>To: Community support list for Wireshark
>>>Subject: [Wireshark-users] transparent GTP-'detunneling' in wireshark
>>>
>>>Hello community,
>>>is it possible to ssomehow 'de-tunnel' GTP traffic, so that read
>>>filters can be naturally applied to the traffic tunneled inside GTP?
>>>
>>>/wbr
>>>Ariel Burbaickij
>>>_______________________________________________
>>>Wireshark-users mailing list
>>>Wireshark-users@xxxxxxxxxxxxx
>>>https://wireshark.org/mailman/listinfo/wireshark-users
>>>
>> _______________________________________________
>> Wireshark-users mailing list
>> Wireshark-users@xxxxxxxxxxxxx
>> https://wireshark.org/mailman/listinfo/wireshark-users
>>
>
