I am attempting to apply a display filter based on the ISAKMP Intiator SPI, which is f64e30753a4a41b6. I have used the filter builder (expression) and as soon as I paste in either f6 4e 30 75 3a 4a 41 b6 or f64e30753a4a41b6 then the filter is shown as being invalid. I have tried "f64e30753a4a41b6" and "f6 4e 30 75 3a 4a 41 b6" which works for the filter checker, but does not output any data even though I can see packets with ISAMP SPI set to f64e30753a4a41b6. Any ideas? Thanks, Pat asked 03 Jul '17, 15:58  patgrogan_ac... |
One Answer:
Have you tried answered 04 Jul '17, 02:19  Uli edited 04 Jul '17, 12:15 |
This worked fine. Thanks for the information. Pat
If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.