Wireshark-users: [Wireshark-users] Mate: Transformations
From: Rohit Mediratta <rohit_medi@xxxxxxxxxxx>
Date: Sun, 13 Jun 2010 04:56:51 -0700
Hi,
  I am struggling with grouping of groups for the following situation

Conversation 1:
Packet-Request               contains Index1 and a TLV with Tunnel-Id1.
Packet-Response             is tunneled with Tunnel-ID1, it contains Index1 and a TLV with Tunnel-Id2.
followUp-Packet-Request   is tunneled with Tunnel-Id2. packet contains Index2
followUp-Packet-Response is tunneled with Tunnel-Id1. packet contains Index2
followUP2-Packet-Request is tunneled with Tunnel-Id2.  packet contains Index3
followUP2-Packet-Response is tunneled with Tunnel-Id1.  packet contains Index3

Conversation 2:
After 30seconds
Packet2-Request             contains Index1 and a TLV with Tunnel-Id3.
Packet2-Response            is tunneled with Tunnel-ID3, it contains Index1 and a TLV with Tunnel-Id4.
..
..
.

How can I use MATE to create a GoG which will be able to monitor/follow each Conversation?

My experiments so far:
    1. I can follow the Packet-Request/Response in the Gog if I match based on "Index1". However, "Index1" is not available in the "followUp-Packet-Request".
    2. I can monitor all requests, or all responses, but cannot monitor the entire conversation.
   

thank you for your suggestions/recommendations,
Rohit
PS:
  If I understand the working of MATE, I'd like to contribute to the documentation. I'd be happy to get pointers on how to do this.