Hello, Is it possible to capture in tshark the dump which:
If yes, which capture-filter needs to be applied? Thanks in advance! asked 13 Feb '14, 05:51  mrav edited 13 Feb '14, 06:10 |
One Answer:
Every FIX message starts with the string '8=FIX', followed by a version number. So, you need to filter for that string. This can be done with a simple capture filter, like the following:
HOWEVER: That will only work, if there are not TCP options. If there are options, you must adjust the offest [20:4], according to the bytes consumed by the TCP header options. And if some implementation does not adhere fully to the standard, and uses lower case letters (8=fix), the capture filter won't work, as it only matches upper case letters. As that's kind of odd, there is a better/simpler way. ngrep:
Ngrep will search for the string '8=FIX' (-i is ignore case) in any tcp frame from/to 1.2.3.4 (replace that with the IP address in your environment). Every matching frame will be written to fix.pcap. Regards answered 13 Feb '14, 12:15  Kurt Knochner ♦ edited 14 Feb '14, 02:21 |
