I want to use the Bridge Priority field in a BPDU packet as a capture or display filter, is it possible?? How can I do it?? asked 29 Oct '15, 08:39 MehranBazgir |
One Answer:
Highlight the Bridge Priority field in Wireshark's Packet Details pane, and then look down to the status bar to see the field name, which for regular STP will be "stp.bridge.prio". You can use that in a display filter. Or, to find the field name even if you can't find a field in a packet, click on the "Expressions" button on the display filter toolbar, scroll down to the protocol, STP in this case, and you will see all the fields/expressions you can use in display filters listed there. There is no capture filter keyword for the Bridge Priority field, however, if the bridge priority field is always found at a fixed offset from the start of the frame, you could build a capture filter using byte-offset notation. See the tcpdump man page for complete capture filter syntax. answered 29 Oct '15, 08:55 Jim Aragon |