This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

UUID (FT_GUID) Filtering

0

Hello all,

I was working with a pcap file and I tested following filter definition:

  • the filter "dcerpc.dg_act_id" works
  • the filter "dcerpc.dg_act_id == 0c41f903-0000-1010-b841-123412341236" doesn't work.

Do I use the filter correctly or is there a bug about filtering UUID?

asked 10 Nov '16, 22:17

BirolCapa's gravatar image

BirolCapa
309915
accept rate: 0%

I don't have a capture file with this field in it to test things with. It would help if you could supply one (you can use cloudshark or any online file sharing service)

(11 Nov '16, 03:43) SYN-bit ♦♦

Hello, thank you for your feedback. You may access the related pcap file by using the following link:

http://bit.ly/2fHdRLL

(11 Nov '16, 03:49) BirolCapa

One Answer:

0

Thanks for the pcap, it looks like all filtering on fields of type "Globally Unique Identifier" are failing in wireshark 2.2.1 and while they are working in wireshark 1.12.13.

Could you file a bug report on https://bugs.wireshark.org? Please also attach the capture file to the bug for bugfixing/testing purposes.

answered 11 Nov '16, 04:08

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 11 Nov '16, 04:08

Hello, I created a bug report:

Bug 13121 - UUID (FT_GUID) Filtering (edit)

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13121

(11 Nov '16, 04:33) BirolCapa