Wireshark Filter look not macth

[meandaneth]

Dear All,

Can you help me to look into wireshark filter as sip && ((ip.src==119.82.250.5 && ip.dst==202.83.198.7) || (ip.src==202.83.198.7 && ip.dst==119.82.250.5)). The filter look correct but when capture it won't and was capture with other ip which is unwanted.

Can you help me?

Thanks,

[Daniele Giordano]

Your filter is OK.

I've succesfully tested this similar case with wireshark version 1.4.1 and 1.2.6:

icmp && ((ip.src == 192.168.1.10 && ip.dst == 151.1.1.1) || (ip.src == 151.1.1.1 && ip.dst == 192.168.1.10))

Divide your filter rule in 3 rules and make different tests:

1) sip only;

2) ip.src==119.82.250.5 && ip.dst==203.83.198.7 only;

3) sip && (ip.src==119.82.250.5 && ip.dst==203.83.198.7);

Good luck.

[meandaneth]

Hi,

I use port mirror on my switch but i feel sometime this filter work but sometime not.

i used wireshark version 1.2.6. But atleast if it not mactch, it won't capture else ip. Any other option ?

Best Regards,

Daneth