This is our old Q&A Site. Please post any new questions and answers at

Hello all,

I was working with a pcap file and I tested following filter definition:

  • the filter "dcerpc.dg_act_id" works
  • the filter "dcerpc.dg_act_id == 0c41f903-0000-1010-b841-123412341236" doesn't work.

Do I use the filter correctly or is there a bug about filtering UUID?

asked 10 Nov '16, 22:17

BirolCapa's gravatar image

accept rate: 0%

I don't have a capture file with this field in it to test things with. It would help if you could supply one (you can use cloudshark or any online file sharing service)

(11 Nov '16, 03:43) SYN-bit ♦♦

Hello, thank you for your feedback. You may access the related pcap file by using the following link:

(11 Nov '16, 03:49) BirolCapa

Thanks for the pcap, it looks like all filtering on fields of type "Globally Unique Identifier" are failing in wireshark 2.2.1 and while they are working in wireshark 1.12.13.

Could you file a bug report on Please also attach the capture file to the bug for bugfixing/testing purposes.

permanent link

answered 11 Nov '16, 04:08

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

edited 11 Nov '16, 04:08

Hello, I created a bug report:

Bug 13121 - UUID (FT_GUID) Filtering (edit)

(11 Nov '16, 04:33) BirolCapa
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 10 Nov '16, 22:17

question was seen: 1,952 times

last updated: 11 Nov '16, 04:33

p​o​w​e​r​e​d by O​S​Q​A