Re: [Ethereal-users] GTP protocoll capture filter help

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 4, 2003, at 2:18 PM, Varga Miki wrote:

> I would need a capture filter in which I can identify GTP packets, 
> which
> have a given MSISDN number.How should I do this?

By determining the port number or numbers that the GTP traffic will 
use, and using a capture filter of

	port {port number}

or, if there's more than one port number,

	port {port number} or port {port number} or ...

> Is it possible to use a pattern for it?

No.  Capture filters in Ethereal are just libpcap filters (as Ethereal 
just uses libpcap/WinPcap to do capturing), and those use a simple 
filtering mechanism (for speed), and that filtering mechanism doesn't 
support arbitrary pattern matching.