This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When I do a filter for my QoS packets using ip.dsfield.dscp==46 I also get DSCP 22 packets

0

All of the DSCP 22 packets are not expected since my filter is only for DSCP 46 packets. All of these DSCP 22 packets are ICMP, stating the destination unreachable (Port unreachable). Is there a reason these packets are being displayed?

asked 16 Sep '15, 08:38

MotoRider's gravatar image

MotoRider
6113
accept rate: 0%

edited 16 Sep '15, 10:38

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572


One Answer:

1

I'm guessing that the embedded IP part of those ICMP packets have DSCP==46, right?

This is a commonly asked question. The trick is to know/remember that the display filter ip.dsfield.dscp == 46 means "there exists a field named ip.dsfield.dscp whose value is 46".

In your case the frame has 2 fields named ip.dsfield.dscp: one with a value of 22 (the outer IP packet) and another with a value of 46 (the IP part of the embedded ICMP packet).

There has been a lot of discussion about this type of problem, in particular to find a method to specify that you're only interested in, for example, the first occurrence of the field within the frame but so far nothing has been done.

answered 16 Sep '15, 10:37

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Correct, there is an embedded IP part, which does have the DSCP==46. I was expecting that it would only find the outer one and then stop, but as you say field exist elsewhere in the frame.

(16 Sep '15, 14:16) MotoRider

Unfortunately when I do a ip.dsfield.dscp!=48, I still get packets with 48 in the DSCP column.

(16 Sep '15, 15:18) MotoRider

Yep, that's the same thing. The outer part has ip.dsfield.dscp!=48 so it gets included, even when the inner part has ip.dsfield.dscp==48. That's why the filter entry box is colored yellow ('this might behave differently than you expect').

The correct filter syntax is !(ip.dsfield.dscp==48)

(17 Sep '15, 04:25) Jaap ♦