This is our old Q&A Site. Please post any new questions and answers at

I've read

But it seems to beg the question of how one can minimize the size of the capture file.

All I care about are VOIP "INVITE" packets.

I've got a filter set: syslog.msg contains "INVITE sip:"

I think it's a "Capture" filter... but even though WireShark's window is only showing the desired packets (very, very few....) it seems to keep chugging along with the total packets.

So, bottom line, is there a way to make WireShark use that filter to not even add non-qualifying packets to it's file? That would enable the running of WireShark for very, very long periods of time without running out of memory.

asked 21 Feb '11, 13:45

PeteCress's gravatar image

accept rate: 0%

The filter syslog.msg contains "INVITE sip:" is not a capture filter, it is a display filter. That means that it doesn't filter out packets from getting into the trace, it only hides them from view. Capture filters are specified in the Capture Options dialog, not in the main window. Unfortunately I do not have a capture filter for you that does what you want to do, but maybe someone else can help you with that.

If nobody can come up with a capture filter you might consider doing a ring buffer capture and running tshark on the files to extract the packets you want every once in a while. That way you can prevent running out of disk space and extract the information you want.

permanent link

answered 21 Feb '11, 14:22

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Check out this page for a reference

Skip down to the line that starts "Capture HTTP Get" - use this sample as a guide.

To build this filter you'll need a packet capture that contains the kind of packet you're going to be looking for as a reference. In other words, do whatever you've done before and use the display filter you listed above - this should produce a few good representative packets. Click on the packet of interest, in Wireshark's middle frame expand the "Syslog message" tree, and look for the "Message: " line. In there you should see the "INVITE sip:" data, click on it. This should highlight an area of text in Wireshark's 3rd/bottom frame, this is the HEX viewer. You need to note into which HEX locations the characters "INVITE sip:" fall. In the only Syslog sample I have it appears that the syslog message starts in 0030. I ASSume that "INVITE sip:" would be located 0030-003a.

SO, you can start building the filter from there..

permanent link

answered 22 Feb '11, 05:27

GeonJay's gravatar image

accept rate: 5%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 21 Feb '11, 13:45

question was seen: 8,228 times

last updated: 22 Feb '11, 05:27

p​o​w​e​r​e​d by O​S​Q​A