Ask Your Question

What capture filter will test whether the DSCP value in the IPv4 header is in a particular range?

asked 2020-07-16 15:31:42 +0000

r.grossmann gravatar image

updated 2020-07-17 22:59:44 +0000

Guy Harris gravatar image


I just want to capture traffic with specific DSCP Value Range. How can I achieve this? Is there a way to filter for an value range or mask?

I did find the following in the wireshark blog:

ip[1] & 0xfc == 0xb8

This one works, but only for DSCP Value 46. I want to capture only packets with DSCP Value Range 8-23...

I tried it with an edited mask and filter value, but this does not work, only the last original filter for EF...:

ip[1] & 0xe0 == 0x20 or ip[1] & 0xe0 == 0x40 or ip[1] & 0x80 == 0xb8 or ip[1] & 0xfc == 0xb8

So can anyone help me?

Kind regards


PS: OS Windows 10 Enterprise x64 1909 18363.959 Wireshark Version 3.2.5 (v3.2.5-0-ged20ddea8138)

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-07-16 15:51:32 +0000

grahamb gravatar image

updated 2020-07-17 07:48:14 +0000

Untested, but a DSCP range of 8-23 means values of the firstsecond (or index [1]) octet of the IP header are between 0x20 and 0x5C inclusive, so with the appropriate mask gives

(ip[1] & 0xFC >= 0x20) and (ip[1] & 0xFC <= 0x5C)
edit flag offensive delete link more


thank you, it works! Solution was too easy^^ I'm almost embarrassed to have asked something simple.

r.grossmann gravatar imager.grossmann ( 2020-07-17 06:35:28 +0000 )edit

@r.grossmann Our habit is not to close successfully answered questions, but simply accept the answer by clicking the checkmark to the left of it. I've reopened the question.

grahamb gravatar imagegrahamb ( 2020-07-17 07:46:41 +0000 )edit

okay. sorry for this. I didn't see the check mark on the left side or and other option to accept the answer. I guess i should go to the doctor to check my eyes^^

r.grossmann gravatar imager.grossmann ( 2020-07-17 08:01:42 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-07-16 15:31:42 +0000

Seen: 1,984 times

Last updated: Jul 17 '20