In wireshark 1.8.5, for wimax-btsCapc interface, searching for a packet through Packet list doesn't show any output. But searching for the same through 'Packet Details' option works. Where could be the probable defect? asked 25 Sep '13, 01:08  sunshine |
2 Answers:
Not all packet details are available in the packet list (there is only a summary line), so a "string" search will not find the same packets. answered 30 Sep '13, 15:19  SYN-bit ♦♦ |
There is no defect in Wireshark. You can simply search in different views
The results of a search operation are obviously different. What are trying to find? Regards answered 01 Oct '13, 03:32  Kurt Knochner ♦ edited 01 Oct '13, 03:48 Issue is with the custom-dissector, I developed. What I want to do is, perform a search with Packet list, which in my case is returning null. (01 Oct '13, 04:00) sunshine
Do you see the search string in the packet list columns (especially the info column)? Can you post a screenshot and highlight the search string in the packet list, or post a capture file (probably useless without the dissector) (01 Oct '13, 05:23) Kurt Knochner ♦ Yes, I can see the string in Info column. Unable to upload screenshot due to policies at workplace. (02 Oct '13, 22:21) sunshine |
What can be done to include all the packets for string search through List?
I'm not sure I understand your question. Do you want to display all packets that contain a certain string? You could use the display filter "frame contains <string>" for that.
If you have written your dissector to generate (named) fields, then you can filter on those fields.
What is the data you want to filter on and how did you add the data to the "tree" in your dissector?
I want do a search based on the content of "Info",last column in the top-most display pane. Search on the basis of packet-list returns null, while on the basis of packet details do point at corresponding packet. Why is it so?.
Searching in the packet-list works for me (version 1.10.0 and 1.8.7). Do you want to search in the packet list (find the next listed packet that matches the search criteria) or do you want to filter the packet list (limit the list of packets to only those that match your search criteria).
In case of filtering, the "info" column is a constructed column for which there is no filterable field. In general, all the info in the "info" column is also available in specific protocol fields.
Can you post an image of the packet-list and packet details of your custom dissector and indicate what you would like to search on?