Wireshark · Ethereal-dev: Re: [Ethereal-dev] Display filter problem

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 24, 2003, at 8:48 AM, Vaidya, Vivek wrote:

> I have a big ethereal trace file which contains trace of lot of SIP 
> calls. I
> wanted to see trace of one particular SIP call. So I tried to use 
> display
> filter:
>
>  eg. sip.Call-ID == "call-974009015-3@10.77.41.200" || sip.Call-ID ==
> "8695144601-5806993502145601-11"
>
> But it displayed packets coming in from the Softswitch to the SIP 
> endpoints,
> but not in the reverse direction.
>
> Would you please let me know what is the problem?

The problem is probably that the packets going in the reverse direction 
don't have data in them that Ethereal dissects as "call ID" fields with 
those values.

We'd probably have to see a capture file with one of the packets that 
*should* have been matched by the filter, but *wasn't* matched by the 
filter, in order to see why that's happening.