Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: Re: [Wireshark-users] Tshark - GTP problem

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: Tamás Varga <Tamas.Varga@xxxxxxxxxxxx>
Date: Fri, 19 Mar 2010 16:16:02 +0100

Turn off dissection of the GTP T-PDUs, then you will be able to filter to the "outer" IP address.
For this purpose, go Edit -> Preferences -> Protocols -> GTP and uncheck "Dissect T-PDU".
cheers,
Tamas

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Salman Malik
Sent: Sunday, March 14, 2010 11:55
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] Tshark - GTP problem

I am trying to filter conversation statistics for headers above GTP using: -q -z conv,udp . But tshark seems to give stats about the headers in GTP payload. I mean not only do I get udp conversation stats of hosts above GTP, but also of those in the payload of GTP. how can I distinguish/filter the two out ?

  • Follow-Ups:
    • Re: [Wireshark-users] Tshark - GTP problem
      • From: Salman Malik
  • References:
    • [Wireshark-users] Tshark - GTP problem
      • From: Salman Malik
  • Prev by Date: Re: [Wireshark-users] Wireshark in Network - Windows/Linux
  • Next by Date: [Wireshark-users] Tool to compare dumps from two hosts and highlight inconsistencies
  • Previous by thread: [Wireshark-users] Tshark - GTP problem
  • Next by thread: Re: [Wireshark-users] Tshark - GTP problem
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation