Hello Luis Ontanon, Thanks for the Link that you've sent. It was of great help.
Thanks, Purandhar > http://wiki.wireshark.org/Mate/Examples#head-024177fe669649345cc7c67b8eb227243d94c764 > > > On 5/31/07, Purandhar Krishnamurthy > <[EMAIL PROTECTED]> wrote: >> Hello, >> >> I would like to create a conditional display filter. When a filter >> criteria is hit on one protocol I would like to change the display >> filter so that it includes an OR'd reference to another protocol. >> >> >> How can I update the wireshark code to modify a display filter on the >> fly ? >> >> Problem Summary >> =============== >> >> We are analysing packes for UMTS. >> >> First we are filtering based on IMSI/Subscriber identity. >> >> For example >> Filter String - "radius._IMSI == 999999999998001" >> >> While we analyse/dissect packets, we update the filter string with >> ip.addr >> (Framed IP address, which we are getting in the Layer1 of Protocol as an >> Attribute Value Pair) >> >> Updated filter string on the fly is : >> >> "radius._IMSI == 999999999998001 || ip.addr == 10.166.104.151" >> >> Then we get list of packets, send and received by that subscriber. >> >> Then we apply another filter to get information for a particular PDP >> context. >> >> Filter String - "radius._IMSI == 999999999998001 || ip.addr == >> 10.166.104.151" >> >> But we are not getting filtered list of packets. We are again getting >> other packets for which IP Address doesn't matches also. >> >> Can anybody assist us, >> >> Thanks in advance, >> Purandhar/Bhowmick >> >> >> _______________________________________________ >> Wireshark-dev mailing list >> [email protected] >> http://www.wireshark.org/mailman/listinfo/wireshark-dev >> > > > -- > This information is top security. When you have read it, destroy yourself. > -- Marshall McLuhan > _______________________________________________ > Wireshark-dev mailing list > [email protected] > http://www.wireshark.org/mailman/listinfo/wireshark-dev > _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
