This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Missing data in PCAP. What am I doing wrong?

0

I have a pcap file saved to my pc. If I provide this pcap to someone else, they can open it and filter for SIP and Q931 data and see the info. If I open it, I only see UDP data and my filter for SIP and Q931 filters zero results. I've tried this on version .99, 1.2.2, 1.6.2 and 1.6.3. The person who can see the data is also running 1.6.2. Has anyone run into this as well?

asked 08 Nov '11, 13:56

David%20Gray's gravatar image

David Gray
1112
accept rate: 0%

edited 29 Feb '12, 19:21

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


One Answer:

0

Most probably your preferences are different from the preferences of the other person. You might want to create a new profile with default settings to see whether that makes a difference.

You can do this by creating a new profile that is based on the profile "Default"

answered 08 Nov '11, 14:03

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Hmmm.. I was using default already. I tried setting another profile, but that didn't work either. I did go find an old pcap file to make sure I wasn't filtering out SIP, and could see that data fine. This is bazaar...

(08 Nov '11, 14:30) David Gray