Ethereal-users: Re: [Ethereal-users] Display Filter issues for TCAP and MTP3

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Wed, 19 Apr 2006 10:40:15 +0800

Andreas Fink wrote:

Hello,
I'm trying to do a display filter to include a specific TCAP transaction ID which in my example is hex 040F (its displayed like this in the tcap dissector). When I do tcap.id == "040F" it is not being accepted. The dialog to enter this hints me to the fact that only a one byte numerical value is being allowed. this would be wrong as transaction ID's can be one or two bytes.
Hmmm, "tcap.identifier" is registered as FT_BYTES which appears to mean you need to use a filter like "tcap.identifer == 04:0f".
Similar problem I'm having if I try to filter using mtp3 pointcodes. They are displayed in ITU format X-XXX-X but I cant enter them like this, I must enter them in 14 bit numerical value (which requires external translation by hand).
They should also be displayed on decimal, at least in the MTP3 dissector (something like "Originating Point Code NNNN (X-XXX-X)".
Yes, this is one of the problems with the dissection of MTP3 point codes: the structured MTP3 point code string is only appended to the point code item, it is not added as a filterable field (except in ANSI and China ITU where the PCs are always formatted as a 8-8-8 string). (Another problem is that not all dissectors show you the structured format.)