0

Trying to filter packets with Wireshark. Why it finds nothing when placing filter tcp contains M-SEARCH. I have such value on the third line.

enter image description here

0

SSDP uses UDP as the underlying transport protocol. You are filtering on TCP.

https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol#Protocol_transport_and_addressing

Try matching UDP text instead.

2
  • I tried UDP contains M-SEARCH, but got the same result - No packet contained that string in its Info column – vico Jul 31 '17 at 11:24
  • Might be the case that the text you see in the Info column, is not actually a field, so you can't filter on it. It's a summary of the the data form the other fields. If you view the details of the packet, you will see in which field M-SEARCH really is shown. – JayMcTee Jul 31 '17 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.