I would like to upload a picture but I get error:" details must have > 10 points"
Anywho, I use: mstp.frame_type ne 0 but I still get all the token passing
How do I filter them out? I am using BACNET MSTP Boyd
Without looking at the trace it is difficult to see the problem. However, the filter mstp.frame_type ne 0 means "show packets where there is at least one field with the name mstp.frame_type that does not have the value 0". In other words, if there are multiple instances of mstp.frame_type in the packets and at least one of them does not have the value zero, the packet is still shows.
The filter not mstp.frame_type eq 0 might work better as it means "show all packets where there is not one field with the name mstp.frame_type that has the value 0".
Please also be aware that filtering is at the packet level, not at the PDU level, so if there are multiple PDU's in one packet, it might not be possible to create a filter that works exactly as you need.
...where "packet" means "link-layer frame" in this context. There are protocols where more than one PDU for that protocol can appear in a single link-layer frame (link-layer PDU) - that's true of most protocols that run over TCP, for example.
Asked: 2019-06-20 15:07:23 +0000
Seen: 338 times
Last updated: Jun 24 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
Much better to share a capture file using a public share (e.g. Google Drive or DropBox etc.), but you can do the same with a screenshot, although it's unlikely to be much use in this case as we'll need to see the data.
the link: TEST1.pcapng (file://RD-LAPTOP-BOYD/Users/bmills.DEVELOPMENT/OneDrive%20-%20VCI%20CONTROLS%20Inc/Wireshark/TEST1.pcapng)
Don't know if that will work, but try!
That won't work. file:/// URLs are URLs that refer to local files, and work only on your machine. I infer from the "OneDrive" that it's on OneDrive; presumably there's some way to get a public URL for files on OneDrive, so that people on other machines can download the capture from OneDrive.