Wireshark Info Filter Help

Question

I have looked all over the net for a tutorial on how to filter the info column but cant find any that makes sense.

I want to filter all logs where the info column contains the text "insitu-conf" but cant find out how. Help please.

Solution

You actually can't do this directly. The info column is decoded based on the properties of the packet, though, and you can filter on these which will have exactly the same effect. The only difference is you have to figure out what info wireshark is using to create that info line, which may be non-intuitive.

In this example, 'insitu-conf' is a port alias for port 1490 (grep insitu-conf /etc/services) and so wireshark is telling you that this is a packet from remote port 51811 to local port 1490. Thus, the filter to caputre those packets would be 'dst port=1490'.

In other instances, there may be a more descriptive info line which is derived from several properties of the packet, including the port and some of the data -- for instance, http requests on port 80 will have an info line that actually includes the first line of the http request.

Comments

[Ozzy]

well in the info column it looks like this 51811 > insitu-conf [ACK] Seq=5 and so on...

[Ozzy]

this explained it perfectly for me ty

[Ozzy]

this helped me alot aswell but the first post explained in more detail. thats why i gave him the answer, thanks

[ychaouche]

Is this an example of poor application design ? I mean, the data is already there, in the treeview cells... Woudn't it be nice to have like two kinds of filters ? one on the protocols and one on the treeview cells ?