This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I'm trying to find out the way to make a display filter that includes two different, but related, protocols. I mean, SIP messages contains information about RTP ports. What I am doing now is:

  1. Filter a SIP flow
  2. Analyse which ports RTP is using
  3. Add this information to the display filter
  4. Filter again.

I'd like to develop a filter to do it automatically but I've seen nothing similar. Should I develop a chained-dissector, a post-dissector or should I develop inside display filter?

I've taken a look at this: http://wiki.wireshark.org/Lua/Examples#Dump_VoIP_calls_into_separate_files

Thanks

asked 21 Nov '12, 04:27

Robin's gravatar image

Robin
6225
accept rate: 0%


MATE is your friend here.

permanent link

answered 22 Nov '12, 04:09

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

I've just read the description, it seems to fit perfect. Thank you so much!

(22 Nov '12, 04:56) Robin
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×238
×165
×109

question asked: 21 Nov '12, 04:27

question was seen: 2,442 times

last updated: 22 Nov '12, 04:56

p​o​w​e​r​e​d by O​S​Q​A