Using WS 4.2.5
I am looking at gtpv2 traffic.
Looking for some kind of display logic that is something like “If gtpv2.cuase==73, display that packet and the packet indicated in gtpv2.response_to header.”
The ultimate goal is to display CREATE SESSION REQUESTS and their correlating CREATE SESSION RESPONSE messages, when the CSResp has gtpv2.cause==73. When I have close to a million packets to sift through, it is taking me a long time to filter through manually this way.
I set columns for “gtpv2.response_in” and “gtpv2.response_to”, but I cannot figure out how to set a display filter that references a packet number that is displayed in the decoded info.
Ders is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.