When I want to trace my Gn (SGSN-GGSN) or IuPS (SGSN-RNC) interfaces using Wireshark, I'd like to use Capture Filter (instead of Display Filter) as I have a lot of traffic going on these interfaces. GTP protocol is used on those interface. So "inner IP" are encapsulated
See an example here of a GTP pcap : http://goo.gl/ZdFSvu
So if I want to only filter this particular inner IP (10.145.254.1) using "host 10.145.254.1" or "net 10.145.0.0/16", I don't see any packets on my wireshark as "Capture filter" is filtering with the "outer IP" (that is 10.152.10.89 or 10.152.12.101).
With which capture filter string can I achieve this ?
asked 08 Apr '14, 18:35
edited 08 Apr '14, 21:33
I tested the above filter after replaying the capture file using playcap and it worked in my test.
answered 10 Apr '14, 07:37