Hi Experts, I want to correlate multiple GoPs based on certain attribute from each PDU. How can I build a logic using MATE scenario (e.g) SIP packet which has media port information H248 packet which also has media port information I want to group SIP and H248 packet where the media port is of same value BR, sshark |
Do you want to correlate multiple GoPs or create a new GoP which contains the SIP and H248 packets? If the former then you want to create a Group of Groups. In that example If the latter then, well, just create another GoP. I would be happy if a GoG serves my purpose. Pls refer the attached mate config example. I am having issues or confusion on how to compare two attributes
(15 Sep '15, 07:16)
sshark
(FYI I converted your Answer to a Comment--see the FAQ.) For (1), yes, you'd need to put mport in both the For (2): that's a bug in Wireshark. I submitted a change to have that fixed.
(15 Sep '15, 08:00)
JeffMorriss ♦
So, do you think - this should be a valid configuration for my purpose My actual display filter would be - mate.tester.user == xyz to filter all related SIP & H248 packets
(18 Sep '15, 01:26)
sshark
That looks about right. I'm not sure about the "user" part in this line:
I suspect that might break things but who knows...
(18 Sep '15, 10:48)
JeffMorriss ♦
Ok, user is needed as I have to filter the trace based on user and not based on media port. Above works, except the mate.released_time related error I reported before One last question - I do have some megaco packets before the initial SIP packet, hence I could not get those megaco packets as I could not match the mport. Is it possible to process PDUs/GoPs in reverse direction or after certain PDUs are processed ?
(19 Sep '15, 05:49)
sshark
Hmm, I thought that would be covered by the "Extra(user)" part rather than the "Member" part. But then again I'm not sure I've ever used a GoG in anger.
Excellent. If you pick up an automated build then that error will go away (the change was merged). For your last question: I actually would have thought it would have worked like that today since the
(21 Sep '15, 17:53)
JeffMorriss ♦
showing 5 of 6
show 1 more comments
|