This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

UUID (FT_GUID) Filtering

Hello all,

I was working with a pcap file and I tested following filter definition:

the filter "dcerpc.dg_act_id" works
the filter "dcerpc.dg_act_id == 0c41f903-0000-1010-b841-123412341236" doesn't work.

Do I use the filter correctly or is there a bug about filtering UUID?

filter uuid dcerpc

asked 10 Nov '16, 22:17

BirolCapa
30●9●9●15
accept rate: 0%

I don't have a capture file with this field in it to test things with. It would help if you could supply one (you can use cloudshark or any online file sharing service)

(11 Nov '16, 03:43) SYN-bit ♦♦

Hello, thank you for your feedback. You may access the related pcap file by using the following link:

http://bit.ly/2fHdRLL

(11 Nov '16, 03:49) BirolCapa

One Answer:

Thanks for the pcap, it looks like all filtering on fields of type "Globally Unique Identifier" are failing in wireshark 2.2.1 and while they are working in wireshark 1.12.13.

Could you file a bug report on https://bugs.wireshark.org? Please also attach the capture file to the bug for bugfixing/testing purposes.

answered 11 Nov '16, 04:08

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

edited 11 Nov '16, 04:08

Hello, I created a bug report:

Bug 13121 - UUID (FT_GUID) Filtering (edit)

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13121

(11 Nov '16, 04:33) BirolCapa