Archive

Archive for June, 2012

Useful Riverbed SteelHead Wireshark Filters

June 16th, 2012 No comments

Useful Wireshark filters

To Find Inner channel splice setup: rvbd.sport.setup.type eq 0x1

Using Riverbed Wireshark 1.8.2 you can use a new feature to find all inner channel traffic for a conversation. You can for instance use the Inner channel splice setup filter rvbd.sport.setup.type eq 0x1 to display all splice setups or some other method.

When you have identified the splice connection you are interested in you can then right click on the connection in Wireshark and choose the ‘Find the inner channel’ option to try to locate the entire inner channel connection. You can also right click on any part of an optimised connection to obtain the same result.

Read more…