http://wiki.wireshark.org/Mate/Examples#head-024177fe669649345cc7c67b8eb227243d94c764
On 5/31/07, Purandhar Krishnamurthy <[EMAIL PROTECTED]> wrote: > Hello, > > I would like to create a conditional display filter. When a filter > criteria is hit on one protocol I would like to change the display > filter so that it includes an OR'd reference to another protocol. > > > How can I update the wireshark code to modify a display filter on the fly ? > > Problem Summary > =============== > > We are analysing packes for UMTS. > > First we are filtering based on IMSI/Subscriber identity. > > For example > Filter String - "radius._IMSI == 999999999998001" > > While we analyse/dissect packets, we update the filter string with ip.addr > (Framed IP address, which we are getting in the Layer1 of Protocol as an > Attribute Value Pair) > > Updated filter string on the fly is : > > "radius._IMSI == 999999999998001 || ip.addr == 10.166.104.151" > > Then we get list of packets, send and received by that subscriber. > > Then we apply another filter to get information for a particular PDP context. > > Filter String - "radius._IMSI == 999999999998001 || ip.addr == > 10.166.104.151" > > But we are not getting filtered list of packets. We are again getting > other packets for which IP Address doesn't matches also. > > Can anybody assist us, > > Thanks in advance, > Purandhar/Bhowmick > > > _______________________________________________ > Wireshark-dev mailing list > Wireshark-dev@wireshark.org > http://www.wireshark.org/mailman/listinfo/wireshark-dev > -- This information is top security. When you have read it, destroy yourself. -- Marshall McLuhan _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev
