I just tried this filter on an SCTP capture I have:
sctp.chunk_type != 0 && sctp.chunk_type != 3
(I'm only really interested in the control messages at the moment--thus I want to filter out the DATA and SACK chunks.)
What I got surprised me: SCTP messages that had just DATA or just SACKs were excluded from the display, but messages that had DATA and SACKs bundled together were displayed.
Is this "correct"? If not, do you think it's a "packet-sctp.c" problem or a filter code problem?
Regards, -Jeff
ps. this is with 0.9.9 + a couple non-related patches.
-- Jeff Morriss Senior Software Support Engineer Ulticom, Inc. Helpdesk: +1-856-787-2765 Fax: +1-856-222-9947
