title: Using tshark filter with SIP tcp trace
body: <p>I have the following trace  :</p>
  
  <p><img src="https://i.stack.imgur.com/gS8td.jpg" alt="enter image description here">:</p>
  
  <p>In the wireshark preferences I have the following option set to Off : </p>
  
  <p>In TCP Prefs : Allow subdissector to reassemble TCP streams</p>
  
  <p>In SIP prefs : Reassemble sIP headers spanning multiple TCP segments</p>
  
  <p>In SIP prefs : Reassemble sIP bodies spanning multiple TCP segments</p>
  
  <p>I am trying to analyze this trace with the tshark command given below. But in the output I am not shown any packets even though the packets are there in the trace : </p>
  
  <pre><code>[rishabh@pc Test]$tshark -T fields -E header=y -e ip.src -e tcp.srcport -e ip.dst  -e tcp.dstport -R "sip.Status-Code eq 500" -r "4.cap"
  ip.src  tcp.srcport ip.dst  tcp.dstport
  [rishabh@pc Test]$ 
  </code></pre>
  
  <p>How do i modify the filter to capture the highlighted packet?</p>
  
  <p>I found out that if I switch on all of the above wireshark options the TCP packets are shown as  :
  <img src="https://i.stack.imgur.com/JQRCE.jpg" alt="enter image description here"></p>
  
  <p>Maybe tshark allows reassembly by default and thus it is not able to filter the packet as a SIP message. Also I am able to capture the data with the tshark filter : "tcp contains '500 Responder'"</p>
  
  <p>But I need to filter it as a sip status code only. How do I achieve this? </p>
  
  <p>Note that the SIP status code is indeed 500, so the initial filter should work.</p>