Hello I'm newbie to Wireshark, not sure if it's known question or issue. I use "l2tp.sid==0" to set display-filter to filter l2tp control packets and work well. but it was failed to work w/ capture-filter w/ syntax error. Could anybody to let me know if it's possible to set such capture-filter and how if the answer is yes, thanks in advance! asked 13 Feb '14, 21:39  guyin edited 10 Sep '16, 12:14  sindy |
One Answer:
Actually L2TP control messages are identified by the control flag in the L2TP header. Display filter for control messages
The same in capture filter syntax (highest bit in the first byte of the UDP payload is the control flag)
If you want to filter for the SID, the following capture filter will work
HINT: there can be control messages with a SID != 0, so if you only filter for the SID, you might miss some control messages. You can obviously also combine the two
which will filter for frames with the control flag set and SID == 0. ++ UPDATE ++ For L2TPv3 directly at the IP level (see your comment about DOCSIS), the whole thing works like this: According to your screenshot, you can identify L2TPv3 frames in the IP frame with
and then you can use the same filters I mentioned above, just adjusted to the new location in the IP frame. The 'limitations' regarding the control message flag and the SID are the same. So, the full filter would be
or with the SID
According to the capture files at bugs.wireshark.org, it is ip[20:4] for the SID (display field: l2tp.sid). Hint: This will only work, if there are no additional IP options. If there are, you need to adjust the offset in the IP frame according to the IP options length. Regards answered 14 Feb '14, 02:13  Kurt Knochner ♦ edited 16 Feb '14, 05:20 showing 5 of 6 show 1 more comments |
Hi, Kurt
Thanks for your info. Actually my case is to capture DOCSIS DEPI control packets whihch is L2TPv3 over IP. since there is no UDP and also can't use type flag but control session id to identify the control packets. How can I revise the filters you offered in such case?
can you post a small sample capture file somewhere (google drive, dropbox, cloudshark.org)?
Hi, Kurt Pls refer to following link for a screen capture of one DEPI control packets. you can see the l2tp header right next to IP header and session id is 0. I think we can use something like ip[x:y] to represent the session id field but not sure the exact syntax. https://dl.dropboxusercontent.com/u/83185044/Screen%20Shot%202014-02-16%20at%2010.58.23%20AM.png
see the ++ UPDATE ++ in my answer.
Hi, Kurt
Thanks a lot for your help! the "ip proto l2tp && ip[20:4]==0" works fine w/ my case. of course it's not complete just simple to match my specific case. thanks again for your help!
Of course that's a bit easier to read ;-))
Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up)