wireshark-users October 2010 archive
Main Archive Page > Month Archives  > wireshark-users archives
wireshark-users: Re: [Wireshark-users] tshark filter

Re: [Wireshark-users] tshark filter

From: Guy Harris <guy_at_nospam>
Date: Mon Oct 18 2010 - 17:43:28 GMT
To: Community support list for Wireshark <wireshark-users@wireshark.org>

On Oct 18, 2010, at 9:47 AM, David Milbourne wrote:

> That shows me all the successful and unsuccessful logins. Is there an easy way of filtering out all the unsuccessful logins so I don't see all the password guessing attempts?

Unfortunately, no; the FTP dissector doesn't associate requests and responses (or even associate a USER request and the following PASS request), so you can't specify a filter that selects only requests that have successful responses.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@wireshark.org?subject=unsubscribe