Ethereal-users: Re: [Ethereal-users] creating a PCAP file from unencapsulated MTP3 traces

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>
Date: Thu, 5 May 2005 17:56:26 +0200
Hi Luis,

for MTP2 it is very simple. You can just have the MTP2 message
as the packet in a libpcap file with DLT value of 140. If you put

0000 77 77 00
0000 77 78 01 02
0000 77 79 02 03 04

in a file with name mtp2.txt with the command

text2pcap -l 140 mtp2.txt mtp2.pcap

you can process it with ethereal.

If you put MTP3 packets in the file you need to
use the -l 142 option.

I hope this helps.

Best regards
Michael

On May 5, 2005, at 4:33 PM, LEGO wrote:


Hi,
I got MTP3 messages taken directly from a trace in a network element
(just unencapsulated MTP3 with timestamps). I'm writing a script to
import these into ethereal.

I've already created a script that fits the mtp3 message over
m3ua/sctp/ip/eth but I find it cumbersome to add that much data to
decode mtp3 and it's payload since I noticed Wiretap has already an
mtp2 "encapsulation".  So far I haven't been able to figure out which
format to use.

How the MTP2 file is formatted?

Thanks,

Luis

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users