title: Wireshark Filters: Getting the packet that was sent before the filtered one
body: <p>I am trying to create a filter in Wireshark that will grab all SMB responses that return "Error: STATUS_NO_SUCH_FILE". I would also like the be able to grab the packet before the filtered ones. Here's an example:</p>
  
  <pre><code>No. Time        Source      Destination Proto.  Length  Info
  26482   24.832997   192.168.1.62    192.168.1.4 SMB 288 Trans2 Request, QUERY_PATH_INFO, Query File Basic Info, Path: \1_CLIENTS\CLIENTS\ACME INC
  26483   24.833122   192.168.1.4 192.168.1.62    SMB 158 Trans2 Response, QUERY_PATH_INFO
  26484   24.833232   192.168.1.62    192.168.1.4 SMB 306 Trans2 Request, FIND_FIRST2, Pattern: \1_CLIENTS\CLIENTS\ACME INC\&lt;.AC_
  26485   24.833909   192.168.1.4 192.168.1.62    SMB 126 Trans2 Response, FIND_FIRST2, Error: STATUS_NO_SUCH_FILE
  </code></pre>
  
  <p>The following filter grabs the "STATUS_NO_SUCH_FILE" packets:</p>
  
  <pre><code>((ip.src == 192.168.1.4) &amp;&amp; (ip.dst == 192.168.1.62)) || ((ip.src == 192.168.1.62) &amp;&amp; (ip.dst == 192.168.1.4)) &amp;&amp; (smb.nt_status == 0xC000000F)
  </code></pre>
  
  <p>But I would also like to get the packet previous to that one as well so I know which file path wasn't found.</p>