Wireshark · Wireshark-users: Re: [Wireshark-users] tshark filter

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 18, 2010, at 9:47 AM, David Milbourne wrote:

> That shows me all the successful and unsuccessful logins.  Is there an easy way of filtering out all the unsuccessful logins so I don't see all the password guessing attempts?

Unfortunately, no; the FTP dissector doesn't associate requests and responses (or even associate a USER request and the following PASS request), so you can't specify a filter that selects only requests that have successful responses.