Wireshark-users: Re: [Wireshark-users] wireshark display filters: display range of termination id
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Manolis Katsidoniotis <manoska@xxxxxxxxx>
Date: Fri, 14 Oct 2011 10:25:39 +0300
Many thanks Joke

-------------------------------------------------

TCP port is integer so

ip.dst== 192.168.100.82 && (tcp.srcport >= 1000 && tcp.srcport <= 2000)

will do the trick

-------------------------------------------------

"port_1" is string so

ip.addr == x.x.x.x && (megaco.termid >= "port_1" && megaco.termid <= "port_40")

is not working


Furthermore
H.248 TPC port is standard 2944 (only the terminations vary and they are exchanged @ H.248 level)
so this is working but cannot provide the required result.

Does anyone happen to know how to sub-string and then convert the outcome to integer inside a wireshark filter?

Or any other ideas are of course welcome :)))


Thanks
Manolis