| Main Archive Page > Month Archives > wireshark-users archives |
Re: [Wireshark-users] tshark filter
From: Guy Harris <guy_at_nospam>Date: Mon Oct 18 2010 - 17:43:28 GMT
To: Community support list for Wireshark <wireshark-users@wireshark.org>
On Oct 18, 2010, at 9:47 AM, David Milbourne wrote:
> That shows me all the successful and unsuccessful logins. Is there an easy way of filtering out all the unsuccessful logins so I don't see all the password guessing attempts?
Unfortunately, no; the FTP dissector doesn't associate requests and responses (or even associate a USER request and the following PASS request), so you can't specify a filter that selects only requests that have successful responses.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@wireshark.org?subject=unsubscribe