Ethereal-users: Re: [Ethereal-users] GTP protocoll capture filter help

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 4 Nov 2003 14:22:44 -0800

On Nov 4, 2003, at 2:18 PM, Varga Miki wrote:

I would need a capture filter in which I can identify GTP packets, which
have a given MSISDN number.How should I do this?

By determining the port number or numbers that the GTP traffic will use, and using a capture filter of

	port {port number}

or, if there's more than one port number,

	port {port number} or port {port number} or ...

Is it possible to use a pattern for it?

No. Capture filters in Ethereal are just libpcap filters (as Ethereal just uses libpcap/WinPcap to do capturing), and those use a simple filtering mechanism (for speed), and that filtering mechanism doesn't support arbitrary pattern matching.