Decoding raw MTP3 packets in pcap format
"Keith Fleming" <[email protected]> Mon, 2 Oct 2006 14:58:40 -0500
| Newsgroups | gmane.network.ethereal.user |
|---|---|
| Message-ID | <295C5089A56CE143B316E5F67CA99CB0D9BE25@cowboy.inovate.inovate.com> |
This is a multi-part message in MIME format. --===============0257722375== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------- The Ethereal project is being continued at a new site. Please go to http://www.wireshark.org and subscribe to [email protected]. Don't forget to unsubscribe from this list at http://www.ethereal.com/mailman/listinfo/ethereal-users ------------------- --===============0257722375== Content-Class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6E65C.D0747C74" Content-Transfer-Encoding: 7bit This is a multi-part message in MIME format. ------_=_NextPart_001_01C6E65C.D0747C74 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I have taken some raw SS7 MTP3 data from our application and have converted it to pcap format. Ethereal correctly sees this file's contents but of course it is looking at it as if it was Ethernet. It is MTP3 data, starting with the SIO octet, then the two 24 bit point codes, then the SLS, etc. =20 Is it possible to tell ethereal, "interpret this as MTP3 and don't worry about there not being any link-level (or lower) data" =20 I'm thinking there has to be a way of short circuiting the lower layer dissectors. Any help is appreciated. Thanks in advance. The information contained in this message may be confidential to Kodiak = Networks, Inc. and its subsidiaries and protected from disclosure. If = this message did not reach the intended recipient, or an employee or = agent responsible for delivering it to the intended recipient, you are = hereby informed that any distribution or copying of this communication = is prohibited. If you have received this communication in error, please = notify us immediately by replying to the sender of the message and then = delete the message. Thank you. ------_=_NextPart_001_01C6E65C.D0747C74 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)"> <style> <!-- /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} a:link, span.MsoHyperlink {color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:Arial; color:windowtext;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in;} div.Section1 {page:Section1;} --> </style> </head> <body lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>I have taken some raw SS7 MTP3 data from our = application and have converted it to pcap format. Ethereal correctly sees this = file’s contents but of course it is looking at it as if it was Ethernet. It is = MTP3 data, starting with the SIO octet, then the two 24 bit point codes, then = the SLS, etc.<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>Is it possible to tell ethereal, “interpret = this as MTP3 and don’t worry about there not being any link-level (or = lower) data”<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>I’m thinking there has to be a way of short = circuiting the lower layer dissectors. Any help is appreciated. Thanks in = advance.<o:p></o:p></span></font></p> </div> <BR> <BR> The information contained in this message may be confidential to Kodiak = Networks, Inc. and its subsidiaries and protected from disclosure. If = this message did not reach the intended recipient, or an employee or = agent responsible for delivering it to the intended recipient, you are = hereby informed that any distribution or copying of this communication = is prohibited. If you have received this communication in error, please = notify us immediately by replying to the sender of the message and then = delete the message. Thank you. </body> </html> ------_=_NextPart_001_01C6E65C.D0747C74-- --===============0257722375== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ethereal-users mailing list [email protected] http://www.ethereal.com/mailman/listinfo/ethereal-users --===============0257722375==--