aix iptrace capture filters
I am analyzing an Aix iptrace which was ftp'd to my windows10 laptop from the AIX instance where it was taken. Wireshark is running on my wndows 10. I open the iptrace in wireshark (OK) . Where I'm lost is on setting up the capture filters. Two key points (1) wireshark seems to be presenting the LOCAL ethernet interfaces on my windows system whereas I'm interested in filtering the IP trace file to identify dropped packets. (2) In the capture options pane I type in arguments given me by IBM support (who are experienced wireshark users) .. Both options begin with 'tcp'' . But anything I type after tcp causes the pane to turn from green ( tcp only entered) to red ( tcp.x.y_z) .. When red , the start button is grayed out and I cannot start the analysis.
Are you trying to read an existing capture file made with iptrace, are you trying to perform a new capture with Wireshark rather than iptrace, or are you trying to do both?
I'm afraid it is merely the case of mixing up capture filters and display filters. The OP has stated that an existing capture has been uploaded to the machine where he uses Wireshark.
The tcp\..*syntax of suggested filter conditions supports this assumption.So the only thing which puzzles me is how a capture filter field can remain accessible once a capture file has been already loaded.
Can you place here a screenshot of the Wireshark window where you try to enter the capture filter? Because it seems that you either have not loaded the capture file at all, or you went
Capture->Capture filtersin the menu which takes you to a capture filter manager which is not relevant to an already open capture file.So after opening the file, fill your filter expressions into the display filter field right below the menu icons, and press the arrow at ...(more)