Analyze filter smb2.cmd == 9 && smb2.filename contains "fname" shows no results

edit

smb2.cmd==9 && smb2.filename

shows 29 packets, but they don't look correctly formatted, e.g.:

242486  471.275337  192.168.1.11    192.168.1.10    SMB2    694 Write Request Len:1048576 Off:4194304 File: Pictures\Lightroom\Catalogs\CrashTestDummy\CrashTestDummy.lrcat-walCreate Request File: Pictures\Slideshows\Screen Saver Photos

Both a Write and Create request are shown in the same entry.

smb2.cmd==9 && smb2.filename contains "lrcat"

shows no packets.

smb2.cmd==9 && smb2.filename contains "Photos"

shows 5 packets, including #242486 above.

Similar problem on smb2-peter.pcap: smb2.cmd == 9 shows 34 packets but smb2.cmd == 9 && smb2.filename contains "txt" shows no packets.

Your capture has packets with more than one SMB2 PDU ?

smb2.flags.chained==1

Adding a column for smb2.cmd will make this easier to see.
If that's the case then we can work on a filter.

Note: May bump up against not being able to filter on specific occurrence

OK, not being able to filter on a specific occurrence explains the problem. So if I want to filter on commands that do not contain filenames, I need to first lookup the filename's fid and filter on that, e.g.:

smb2.cmd == 9 && smb2.fid == 578b565f-0000-0000-71ef-756100000000

which works. If there's a shortcut for doing this, please point me to the documentation.

Thanks!

It's doable with tshark - with multiple passes to get the fid then filter on it, or by filtering on _ws.col.info

There have been requests to filter on the Info column in Wireshark. There is an open enhancement request/issue to support this.