Wireshark · Wireshark-users: Re: [Wireshark-users] Need assistance in creating a display filter

[Abhik Sarkar <sarkar.abhik@xxxxxxxxx>]

Hi Michael,
Once you have the capture and have found the BEGIN, expand the TCAP
portion in the packet details pane, bring up the context menu for the
transaction ID and select 'apply as filter selected'.
That should show you all (captured) MSU's with the same transaction ID.
HTH
Abhik

On 7/17/09, Michael R. Pierotti <mike.pierotti@xxxxxxxxxxxxxxxxx> wrote:
> I am fairly new to Wireshark when it comes to capturing SIGTRAN and need
> assistance in creating a display filter.
>
>
>
> What I am attempting to do is capture the TCAP BEGIN with OpCode 66
> (readyForSM) and all related TCAP ENDS or TCAP ERRORS for those messages.
> Any ideas on how this may be accomplished?
>
>
>
> Thanks,
>
>
>
> Michael R. Pierotti
> GSM/WCDMA Core and Packet Senior System Engineer
>
> cid:image001.jpg@01C93B77.6C392080
>
>
>
> Direct:+1.671.686.9423
>
> Office: +1.671.688.2355, ext. 721
>
> NOC: +1.671.688.2355 ext 760 (24/7, GMT+10)
> Wireless: +1.671.988.0369
>
> GSM: +1.671.788.0369
> Facsimile: +1.671.646.0627
> E-mail:  <mailto:mike.pierotti@xxxxxxxxxxxxxxxxx>
> mike.pierotti@xxxxxxxxxxxxxxxxx
>
>
>
>

-- 
Sent from my mobile device