It seems that all other port numbers (at least the ones that I worked with) are Ok. But, I cannot filter out based on this port number. Why? I tested with version 2.4.5 and 2.2.6.
61883 appears to be a protocol name also (declared in packet-ieee1722.c) which confuses the filtering engine. We should probably rename it to avoid the collision.
I am not super familiar with the filtering engine. But, does that mean I cannot do that with the compiled Windows version?
Until we fix the code (I will upload a patch very shortly) you can workaround the issue by typing the port number in hexadecimal (tcp.port==0xf1bb).
Thanks. That was really helpful :)
If it helped you, please consider marking the answer as correct by clicking on the check mark icon.
The collision with the IEC 61883 protocol is now fixed, and the change will be part of Wireshark 2.4.8 and 2.6.2 once released. Thanks for the report.
Asked: May 23 '18
Seen: 579 times
Last updated: May 23 '18
What exact filter are you attempting to apply?
"tcp.port == 61883". It works with any other port number, but not 61883