Ethereal-dev: Re: [Ethereal-dev] Display filter problem

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 24 Sep 2003 17:57:33 -0700

On Sep 24, 2003, at 8:48 AM, Vaidya, Vivek wrote:
I have a big ethereal trace file which contains trace of lot of SIP calls. I wanted to see trace of one particular SIP call. So I tried to use display 
filter:

 eg. sip.Call-ID == "[email protected]" || sip.Call-ID ==
"8695144601-5806993502145601-11"
But it displayed packets coming in from the Softswitch to the SIP endpoints, 
but not in the reverse direction.

Would you please let me know what is the problem?
The problem is probably that the packets going in the reverse direction don't have data in them that Ethereal dissects as "call ID" fields with those values.
We'd probably have to see a capture file with one of the packets that *should* have been matched by the filter, but *wasn't* matched by the filter, in order to see why that's happening.