This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

All of the DSCP 22 packets are not expected since my filter is only for DSCP 46 packets. All of these DSCP 22 packets are ICMP, stating the destination unreachable (Port unreachable). Is there a reason these packets are being displayed?

asked 16 Sep '15, 08:38

MotoRider's gravatar image

MotoRider
6113
accept rate: 0%

edited 16 Sep '15, 10:38

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572


I'm guessing that the embedded IP part of those ICMP packets have DSCP==46, right?

This is a commonly asked question. The trick is to know/remember that the display filter ip.dsfield.dscp == 46 means "there exists a field named ip.dsfield.dscp whose value is 46".

In your case the frame has 2 fields named ip.dsfield.dscp: one with a value of 22 (the outer IP packet) and another with a value of 46 (the IP part of the embedded ICMP packet).

There has been a lot of discussion about this type of problem, in particular to find a method to specify that you're only interested in, for example, the first occurrence of the field within the frame but so far nothing has been done.

permanent link

answered 16 Sep '15, 10:37

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Correct, there is an embedded IP part, which does have the DSCP==46. I was expecting that it would only find the outer one and then stop, but as you say field exist elsewhere in the frame.

(16 Sep '15, 14:16) MotoRider

Unfortunately when I do a ip.dsfield.dscp!=48, I still get packets with 48 in the DSCP column.

(16 Sep '15, 15:18) MotoRider

Yep, that's the same thing. The outer part has ip.dsfield.dscp!=48 so it gets included, even when the inner part has ip.dsfield.dscp==48. That's why the filter entry box is colored yellow ('this might behave differently than you expect').

The correct filter syntax is !(ip.dsfield.dscp==48)

(17 Sep '15, 04:25) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×165
×74
×7
×5

question asked: 16 Sep '15, 08:38

question was seen: 8,794 times

last updated: 17 Sep '15, 04:27

p​o​w​e​r​e​d by O​S​Q​A