This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to filter tcap.tid with matches ?

0

tcap.tid == 05:95:27:01 I want to filter the tcap.tid begin with 05:::** ,I use tcap.tid contains 05 to filter,ther many GSM_MAP message.I use tcap.tid matches "^05" ,filter nothing

asked 04 Feb '13, 06:48

anshaohui's gravatar image

anshaohui
16●1●1●4
accept rate: 0%

edited 04 Feb '13, 19:33

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142

One Answer:

1

Try tcap.tid matches "^\x05"

answered 04 Feb '13, 19:32

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

it works,thanks,

(05 Feb '13, 02:10) anshaohui

how to filter tcap.tid begin with 05:95?

(05 Feb '13, 02:15) anshaohui

If an answer provides a solution to your issue, please accept it for the benefit of other users by clicking the checkmark next to the answer. Please see the FAQ for more info.

(05 Feb '13, 02:17) grahamb ♦
1

@anshaohui, try tcap.tid matches "^\x05\x95"

(05 Feb '13, 05:22) cmaynard ♦♦

@cmaynard，thanks

(10 Aug '15, 20:00) anshaohui