Wireshark-users: Re: [Wireshark-users] tshark filter

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 18 Oct 2010 10:43:28 -0700
On Oct 18, 2010, at 9:47 AM, David Milbourne wrote:

> That shows me all the successful and unsuccessful logins.  Is there an easy way of filtering out all the unsuccessful logins so I don't see all the password guessing attempts?

Unfortunately, no; the FTP dissector doesn't associate requests and responses (or even associate a USER request and the following PASS request), so you can't specify a filter that selects only requests that have successful responses.