First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

How to filter out entries from the wireshark trace

I want to filter out TNS and TCP entries while i am analyzing an SSL issue. How do i do it. I tried setting under Capture->Capture Filters by specifying name of the filter and the filter options.. It didn't work. Any help on this is highly appreciated.

BalajiPalavalli's avatar
1
BalajiPalavalli
asked 2019-09-23 06:35:18 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

There are two filtering engines in Wireshark:

  1. Capture filters. Capture filters are used when capturing packets from the network and will determine which packets are saved in the pcap file. Capture filters use BPF syntax (see the tcpdump manual page for more details).
  2. Display filters. Display filters are used to select which packets from the pcap file to show on the screen. Display filters have their own syntax.

As you mention capture filters, I assume you want to limit the packets saved to the pcap file. There is no tns filter in the BPF filter language, you will need to filter on ip addresses and ports. So to not capture any TNS packets, you can use not tcp port 1521. Beware that if you are capturing vlan-tagged traffic, you need to change this filter into not (vlan and tcp port 1521).

SYN-bit's avatar
18.5k
SYN-bit
answered 2019-09-23 06:49:09 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer