This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I know that for some protocols, such as http, you can just type "http" in the filter box and wireshark will filter it. However, this doesn't seem to work for many protocols, including MDNS, which is what I'm trying to filter on right now.

Is there a way to filter on what is ACTUALLY displayed in the PROTOCOL column of the list?

asked 02 Aug '13, 07:22

ev1lr0b0t's gravatar image

ev1lr0b0t
1224
accept rate: 50%


However, this doesn't seem to work for many protocols, including MDNS,

You can only search for those 'fields' that are registered by a dissector. As the DNS dissector (which also handles MDNS), does not register a field "MDNS", you can't search for it.

Is there a way to filter on what is ACTUALLY displayed in the PROTOCOL column of the list?

No, that's currently not possible, as there is no way to do a text search in the columns itself.

A possible solution for your problem is this display filter.

dns and udp.port eq 5353

which is a simple definition for MDNS. You can also include the multicast IP

dns and udp.port eq 5353 and ip.addr eq 224.0.0.0/24

Regards
Kurt

permanent link

answered 08 Aug '13, 02:28

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×124
×33
×11

question asked: 02 Aug '13, 07:22

question was seen: 32,004 times

last updated: 08 Aug '13, 02:28

p​o​w​e​r​e​d by O​S​Q​A