Ask Your Question
0

What capture filter will test whether the DSCP value in the IPv4 header is in a particular range?

asked 2020-07-16 15:31:42 +0000

r.grossmann gravatar image

updated 2020-07-17 22:59:44 +0000

Guy Harris gravatar image

Hello,

I just want to capture traffic with specific DSCP Value Range. How can I achieve this? Is there a way to filter for an value range or mask?

I did find the following in the wireshark blog:

ip[1] & 0xfc == 0xb8

This one works, but only for DSCP Value 46. I want to capture only packets with DSCP Value Range 8-23...

I tried it with an edited mask and filter value, but this does not work, only the last original filter for EF...:

ip[1] & 0xe0 == 0x20 or ip[1] & 0xe0 == 0x40 or ip[1] & 0x80 == 0xb8 or ip[1] & 0xfc == 0xb8

So can anyone help me?

Kind regards

Robert

PS: OS Windows 10 Enterprise x64 1909 18363.959 Wireshark Version 3.2.5 (v3.2.5-0-ged20ddea8138)

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-07-16 15:51:32 +0000

grahamb gravatar image

updated 2020-07-17 07:48:14 +0000

Untested, but a DSCP range of 8-23 means values of the firstsecond (or index [1]) octet of the IP header are between 0x20 and 0x5C inclusive, so with the appropriate mask gives

(ip[1] & 0xFC >= 0x20) and (ip[1] & 0xFC <= 0x5C)
edit flag offensive delete link more

Comments

thank you, it works! Solution was too easy^^ I'm almost embarrassed to have asked something simple.

r.grossmann gravatar imager.grossmann ( 2020-07-17 06:35:28 +0000 )edit

@r.grossmann Our habit is not to close successfully answered questions, but simply accept the answer by clicking the checkmark to the left of it. I've reopened the question.

grahamb gravatar imagegrahamb ( 2020-07-17 07:46:41 +0000 )edit

okay. sorry for this. I didn't see the check mark on the left side or and other option to accept the answer. I guess i should go to the doctor to check my eyes^^

r.grossmann gravatar imager.grossmann ( 2020-07-17 08:01:42 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2020-07-16 15:31:42 +0000

Seen: 2,239 times

Last updated: Jul 17 '20

Related questions

vlan capture filter ineffective

how make ip filter in tshark????

Capture Filter - Exclude URL Containing Certain String

tshark capture and filter HTTP in WPA2 secured network

Capture filter for vlan tagged packets and non vlan tagged packets of specific ethertype

With a capture filter on a remote interface, where does the filtering occur? Also, how are the packets transmitted?

I need to setup a mac address filter to capture traffic from different devices.

Wireshark (Version 3.0.0 (v3.0.0-0-g937e33de) ) always shows DSCP value as CS0 for TCP and CS7 for UDP

dumpcap problem with multiple interfaces and filter

Unable to display IEEE1722-1 packet in Wireshark 3.0.3