This is our old Q&A Site. Please post any new questions and answers at

Hi For SIP, I'll like to separate Rejected Calls, Cancelled Calls and Completed Calls and save as separate trace captures. So on menu, I open the 'Telephony --> VoIP Calls'. I sort by State. Highlight all Rejected Calls [as an example] and click 'prepare filter' button. Wireshark prepares the filter based on Call ID. For very long filter strings, it shows red. It appears Wireshark has a LIMIT to the display filter string. Please how do I increase it, so that the display filter accepts more string?

alt text

Thanks in Advance

asked 31 Mar '16, 18:44

EmaX's gravatar image

accept rate: 0%

edited 31 Mar '16, 18:53


As a workaround you can use sip.Call-ID contains "(subset of Call-ID)" instead of a full match with sip.Call-ID == "...".

(05 Apr '16, 01:50) Lekensteyn

Thanks for your response Lekensteyn. But it's not clear to me what you mean.

I have a trace capture I want to analyze. Contains about 100,000 calls. To help me understand, please can you give an example of how I could use sip.Call-ID contains "(subset of Call-ID)" instead of a full match with sip.Call-ID == "...".


(07 Apr '16, 05:37) EmaX

While this is not an answer to the exact wording of your question, it could be an answer to your actual need. You may use MATE to augment all SIP messages belonging to a given SIP dialog with the response code to the initial INVITE of that dialog, and then use this pseudo-field in display filter to display all messages of all dialogs whose initial INVITE has been responded by a given response. So you would e.g. use mate.sip_dialog.rsp_code == 486 to display only messages belonging to SIP dialogs which have failed with "busy here".

The mate configuration looks as follows:

Transform rmv_rq_cseq {
    Match (to_tag, rq_cseq) Replace ();
    Match (method="INVITE");
    Match (rq_cseq) Replace ();

Transform rmv_low_rc {
    Match (rsp_code^"1") Replace ();
    Match (rsp_code="401") Replace ();
    Match (rsp_code="407") Replace ();

Transform rmv_rsp_code {
    Match (rq_cseq);
    Match (rsp_code) Replace (); 

Pdu sip_pdu Proto sip Transport ip {
    Extract rsp_code From sip.Status-Code;
    Extract call_id From sip.Call-ID;
    Extract rq_cseq From sip.CSeq.seq;
    Extract method From sip.Method;
    Extract to_tag From;
    Extract cseq From sip.CSeq;
    Transform rmv_rq_cseq, rmv_low_rc;

Gop sip_xaction On sip_pdu Match (call_id,cseq) {
    Start (method);
    Stop (rsp_code);
    Extra (call_id, rq_cseq, rsp_code);
    Transform rmv_rsp_code;

Gog sip_dialog {
    Member sip_xaction (call_id);
    Extra (rsp_code);
    Expiration 86400.0;
permanent link

answered 09 Apr '16, 02:20

sindy's gravatar image

accept rate: 24%

edited 09 Apr '16, 09:14

The generated display filter is too long, as a workaround you can try to replace long filters such as

 (sip.Call-ID == "40befb2f61f6f2021ed5") or (sip.Call-ID == "233bc04c777e49e8e81e")

by this filter (where the Call IDs are abbreviated to a substring):

(sip.Call-ID contains "40befb2f") or (sip.Call-ID contains "233bc04c")

The string can even be shortened further using a regular expression:

sip.Call-ID matches "(40befb2f|233bc04c)"

The first to second conversion can be done with this Python script (save as for example):

#!/usr/bin/env python
# Reads the display filter from console (standard input) and shortens Call-IDs
# to the first 10 characters (see begin and length parameters below).
import sys, re
begin = 0
length = 10
line = sys.stdin.readline()
def repl(match):
    return 'sip.Call-ID contains "%s"' %[begin:begin+length]
print(re.sub('sip.Call-ID == "([^"]+)"', repl, line))
permanent link

answered 08 Apr '16, 14:08

Lekensteyn's gravatar image

accept rate: 30%

Thanks Again But one last question.

I installed Python, path correct, watched a youtube vid that shows how to run it on sublime text. The thing is where do i store the prepared filter? i.e. what's the easiest way to get it done with python? You could please point me to a video that explains it... Thanks

(08 Apr '16, 17:09) EmaX

Once you run the script, you can paste the original display filter. Then copy the result and replace the original filter.

(09 Apr '16, 03:59) Lekensteyn
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 31 Mar '16, 18:44

question was seen: 1,652 times

last updated: 09 Apr '16, 09:14

p​o​w​e​r​e​d by O​S​Q​A