This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is it possible to use a packet field as a capture or display filter??

0

I want to use the Bridge Priority field in a BPDU packet as a capture or display filter, is it possible?? How can I do it??

alt text

asked 29 Oct '15, 08:39

MehranBazgir's gravatar image

MehranBazgir
21559
accept rate: 0%


One Answer:

2

Highlight the Bridge Priority field in Wireshark's Packet Details pane, and then look down to the status bar to see the field name, which for regular STP will be "stp.bridge.prio". You can use that in a display filter. Or, to find the field name even if you can't find a field in a packet, click on the "Expressions" button on the display filter toolbar, scroll down to the protocol, STP in this case, and you will see all the fields/expressions you can use in display filters listed there.

There is no capture filter keyword for the Bridge Priority field, however, if the bridge priority field is always found at a fixed offset from the start of the frame, you could build a capture filter using byte-offset notation. See the tcpdump man page for complete capture filter syntax.

answered 29 Oct '15, 08:55

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%