Related SMPP submit_sm filter

Question

Hello, everyone! I'd like to filter out SMPP submit_resp's with а non-OK status. It's quite simple:

(smpp.command_id == 0x80000004) && !(smpp.command_status == 0x00000000)

But how can I filter out related SMPP submit_sm's without knowing of an absolute value of the SMPP sequence number? The goal is to create non-interactive tshark filtered dump.

Thanks in advance.

Answer 1

Bash helped me.

It looks like this:

tshark -r $folder/$suff.pcap.gz -Y "$(filter="";sn="";for sn in $(tshark -r $folder/$suff.pcap.gz -Y "(smpp.command_id == 0x80000004) && !(smpp.command_status == 0x00000000)" -Tfields -e "smpp.sequence_number");do filter="$filter || smpp.sequence_number == $sn";done;echo $filter|cut -c 4-)" -w $folder/$host4dump.submit_failed.pcap

For short:

First I look for the SMPP submit_resp's with а non-OK status. I use filter (smpp.command_id == 0x80000004) && !(smpp.command_status == 0x00000000) for this purposes. -Tfields -e "smpp.sequence_number" only extract sequence numbers from the found packets.
Secondly I use this numbers as a new filter.
-w $folder/$host4dump.submit_failed.pcap outpust extracted to a new file.