This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a way to filter out specific SIP messages?

1

I'm monitoring a Cisco CUCM for troubleshooting purposes. All I care about are call setup messages.

The REGISTER and OPTIONS messages are cluttering up the display, and I was wondering if I could filter those out?

asked 23 Sep '11, 08:47

Cisco%20TelePresence%20Guy's gravatar image

Cisco TelePr...
16●1●1●2
accept rate: 0%

One Answer:

2

Apply display filter sip.Method == "INVITE"

answered 23 Sep '11, 12:34

Jaap's gravatar image

Jaap ♦
11.7k●16●101
accept rate: 14%

OK, so if all I want to see are the INVITEs and the dialog that comes after them, I would use:

sip.Method != "REGISTER" or sip.Method != "OPTIONS"

(23 Sep '11, 13:19) Cisco TelePr...
1

@Cisco, I don't know much about SIP, but I think you meant:

(sip.Method != "REGISTER") && (sip.Method != "OPTIONS")
(23 Sep '11, 13:48) helloworld
2

If you want to see them use:
(sip.Method == "REGISTER") || (sip.Method == "OPTIONS")
If you want to hide them use:
!(sip.Method == "REGISTER") && !(sip.Method == "OPTIONS")

(23 Sep '11, 14:32) joke

Yes, I think the last comment is the syntax of what I was looking for. Thanks!

(23 Sep '11, 14:37) Cisco TelePr...

above ones are not filtering all OPTIONS and 200 OK response to OPTIONS message.

But below one is working for that.

sip && !(sip.CSeq.method == "OPTIONS")

(26 Sep '12, 15:50) optionsboy