Is it possible to filter a Wireshark session by the Info column? If so, how?
For example: I would like to filter packets with an expression that looks something like:
The answer by Syn_bit is good and fine. However, using that syntax I'm unable to filter the info column if the data in the info column is within [brackets].
For example: Here's a copy of a packet that contains "ZeroWindowProbeAck" in the info column.
I tried filtering by using this syntax:
Unfortunately, however, this produced zero results.
My guess is that the text that is within brackets are not a part of the actual packet which would explain why I didn't get any search results. So, I took a gander at the actual packet to determine if there is anything in there that is synonymous with searching for ZeroWindowProbeAck, but I couldn't find anything.
Is it possible to search for text that is within brackets? If so, how?
FYI - Here is the full Wireshark packet of the summarized packet that I noted above. Do you see anything in there that would allow me to search for the ZeroWindowProbeAck info?
asked 16 Jan ‘13, 06:48
edited 17 Jan ‘13, 09:47
The info column is not a general field, so it can't be filtered on. However, the information in the info column is a summary of the information in the fields of the highest layer protocol. So you can use the specific protocol fields to filter on.
For your example you could use:
answered 16 Jan '13, 06:59
Items shown in brackets in the Info column are not necessarily actually present in the frame, which is why you can't find them using the "contains" operator. An item enclosed in brackets is information provided by Wireshark about the frame. There is no "TCP ZeroWindowProbeACK" string or value in the frame. Because Wireshark has seen previous frames, it is able to tell you that this frame is an acknowledgment to a zero window probe, but that information is not contained within the frame itself.
You can still filter on that attribute, but you need a different syntax. In this case, "tcp.analysis.zero_window_probe_ack" will show you all the frames that are acknowledgments to zero windows probes.
PS: In the future, when you want to follow up on someone's answer, it would be better to add a comment rather than to edit the original question. It's difficult to follow the conversation if the original question keeps changing.
answered 17 Jan '13, 10:40
edited 13 Mar '13, 11:27
I had to in the past filter by "Application Data" Info column
I did following:
Hope that helps.
This answer is marked "community wiki".
answered 12 Apr '17, 20:48