Ethereal-dev: Re: [Ethereal-dev] ITU/ANSI TCAP dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jeff Morriss <morriss@xxxxxxxxx>
Date: Tue, 07 Oct 2003 11:09:21 -0400

Guy Harris wrote:


On Thu, Sep 11, 2003 at 01:46:00PM -0400, Jeff Morriss wrote:
1) Rewrite a bunch of the TCAP dissector to look at tag IDs as a triplet (class, constructor, tag number) - this probably has negative filtering consequences: users will probably want to filter on "tcap.msgtype == 0x62" instead of just the tag number 


They actually remember that number?  I have the Ethernet types of IPv4
and ARP, and the IP protocol numbers for ICMP and TCP, memorized, but
that's about it.
Probably... There aren't all that many TCAP message types (that are frequently seen anyway). That and many people are used to decoding hex dumps of messages (this is why the raw-SS7 stuff will be quite useful for some of us--yes, I know I owe some responses on that thread). 


They might really want to filter on the message type name instead;
if they did that, it probably wouldn't matter whether the tag number or
the class/{primitive,constructed}/tag value were used.


Cool--I never knew you could do that.  :-)