Wireshark · Wireshark-users: Re: [Wireshark-users] filter rule to check specific message type

[Guy Harris <guy@xxxxxxxxxxxx>]

On Apr 17, 2008, at 1:56 AM, Sudharsanan Ranganathan wrote:

> How do I put a filter rule to check on specific message types during  
> TCP transactions for file download?
> For ex. If I have msg_request, msg_accept, msg_reject. How to  
> identify specific message types from a wireshark capture?

There's no easy way to do that in a capture filter.

In a display filter, however, *if* the protocol that has those message  
types makes the message type a filterable field, you can compare the  
value of that field against the value corresponding to a particular  
message type.  You can either compare the numerical value of the  
filterable field, for example

	smb.cmd == 0x0

or, if the field has associated with it a list of names corresponding  
to the values, compare with the name as a string, for example

	smb.cmd == "Create Directory"

(both of which will compare the value of the "smb.cmd" field with 0,  
as 0 is the code for the SMB "Create Directory" request).