UDP - User Datagram Protocol (udp) Command == udp.srcport udp.dstport udp.port udp.length udp.

checksum Parameter

7 fields:

Parameter Type

Source Port (unsigned, 2 bytes) Destination Port (unsigned, 2 bytes) Source or Destination Port (unsigned, 2 bytes) Length (unsigned, 2 bytes) Checksum Details at: (unsigned, 2 bytes) http://www.wireshark.org/docs/wsug_html_chunked/ChAdvChecksums.htm Good Checksum True: checksum matches packet content;

l udp.checksum_good (Boolean) False: udp.checksum_bad ent; (Boolean) False:

doesn't match content or not checked Bad Checksum True: checksum doesn't match packet cont matches content or not checked

******************************************************** ***********************GTP****************************** GTP: gtp.imsi == "460015760600070" && gtp.message == 0x10" then right click and choos e follow UDP Stream ip.src == 10.43.54.65 or ip.dst == 10.43.54.65 (ip.addr eq 10.8.18.9 and ip.addr eq 10.8.18.59) and (udp.port eq 2123 and udp.p ort eq 2123)