Re: Decoding raw MTP3 packets in pcap format

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to [email protected].
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------


On Oct 2, 2006, at 12:58 PM, Keith Fleming wrote:

> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to =
[email protected]=20
> .
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
> I have taken some raw SS7 MTP3 data from our application and have =20
> converted it to pcap format. Ethereal correctly sees this file=92s =20
> contents but of course it is looking at it as if it was Ethernet.
It is?  That's not an "of course", it's the result of giving the pcap-=20=

format file a file header with a link-layer type of DLT_EN10MB (1); a =20=

different link-layer type would result in a different interpretation.
> It is MTP3 data, starting with the SIO octet, then the two 24 bit =20
> point codes, then the SLS, etc.
>
> Is it possible to tell ethereal, =93interpret this as MTP3 and don=92t =
=20
> worry about there not being any link-level (or lower) data=94
In this case, yes; there's a link-layer type of DLT_MTP3 for exactly =20
that purpose.  It has the value 141.  You'd need to create your file =20
with a link-layer type value of 141 rather than 1.

As per the note added to your message at the top by the Ethereal =20
mailing list software, this would work with Wireshark as well.=