Filter based on other field value

asked 2018-12-02 14:10:19 +0000

Hello experts,

I'm currently analyzing GTP data, and I would like to make a dynamic filter, to find all user plane traffic related to that GTP session.

I've been searching for it, but couldn't find anything.

So, basically the idea is that I create a IP Filter based on the IP contained in the gtp.user_ipv4 field of GTP Create PDP Context Response.

I've tried the following: ip.addr==gtp.user_ipv4

But didn't get any results, so I wonder if there is a way to do it or not. If not, would Wireshark developers consider doing it for future releases?

answered 2018-12-02 14:29:38 +0000

Packet_vlad

1055 ●5 ●75 ●32 http://packettrain.net

updated 2018-12-02 15:55:11 +0000

Have you tried the next format?

ip.addr==${gtp.user_ipv4}

image description

edit flag offensive delete link

Comments

Just did, but unfortunately wireshark regards this filter as invalid.

thepacketwizards ( 2018-12-02 14:52:16 +0000 )edit

Keep in mind you have to select a packet containing gtp.user_ipv4 field first and then type the filter expression.

Packet_vlad ( 2018-12-02 15:06:03 +0000 )edit

Thank you very much! Is there any other way to do it without clicking on the packet?

thepacketwizards ( 2018-12-02 22:34:47 +0000 )edit

By clicking on the packet you define a source for the filter argument. Otherwise if you have for example 100 different packets with different gtp.user_ipv4 values in a trace - which one should the filter use?

For me, optimal routine is:

Write the filter expression;
Create filter button and give it descriptive name (like "This GTP user");
Just click on the packet needed and click on filter button.

Packet_vlad ( 2018-12-03 10:43:13 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Filter based on other field value

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Filter based on other field value edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Filter based on other field value