Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Tshark - GTP problem

From: Tamás Varga <Tamas.Varga@xxxxxxxxxxxx>
Date: Fri, 19 Mar 2010 16:16:02 +0100
Turn off dissection of the GTP T-PDUs, then you will be able to filter to the "outer" IP address.
For this purpose, go Edit -> Preferences -> Protocols -> GTP and uncheck "Dissect T-PDU".
cheers,
Tamas


From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Salman Malik
Sent: Sunday, March 14, 2010 11:55
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] Tshark - GTP problem

I am trying to filter conversation statistics for headers above GTP using: -q -z conv,udp . But tshark seems to give stats about the headers in GTP payload. I mean not only do I get udp conversation stats of hosts above GTP, but also of those in the payload of GTP. how can I distinguish/filter the two out ?