On Nov 23, 2010, at 8:44 AM, Ankith Agarwal wrote:
> Thank you for your valuable suggestions. I have tried out this filter
> expression---"ip[6]&0x02 == 1 and (sip related port numbers)". But, if a
> fragmented SIP packet is encountered, will this filter return the first
> fragments as sip or the
Ankith Agarwal cdac.in> writes:
> Thank you for your valuable suggestions. I have tried out this filter
> expression---"ip[6]&0x02 == 1 and (sip related port numbers)". But, if a
> fragmented SIP packet is encountered, will this filter return the first
> fragments as sip or the last fragment?
H
On Tue, Nov 23, 2010, Guy Harris said:
>
> On Nov 23, 2010, at 12:51 AM, Ankith Agarwal wrote:
>
>> I am trying to filter all the SIP packets using pcap filter on ports of
>> 5060 and 5061. But, some of the SIP packets are fragmented in the IP layer
>> because of their size (greater than MTU).
On Nov 23, 2010, at 12:51 AM, Ankith Agarwal wrote:
> I am trying to filter all the SIP packets using pcap filter on ports of
> 5060 and 5061. But, some of the SIP packets are fragmented in the IP layer
> because of their size (greater than MTU). I wanted to know whether the
> pcap_loop api give
Hi
I am trying to filter all the SIP packets using pcap filter on ports of
5060 and 5061. But, some of the SIP packets are fragmented in the IP layer
because of their size (greater than MTU). I wanted to know whether the
pcap_loop api gives these packets by combinig it, or it just gives the
last
