> The ethereal display filter will only select
> large ( containing many disparate MTP3 messages) ethernet frames.
>
> When I filter on "MTP3 msg xyz between node NE1 and NE2" (as
> specified by M3UA DPC), I get selected frames containing indeed
> the desired xyz but also 95% other MTP3/M3UA/SCTP messages
> from all over the place I am not really interested in.
Are those additional messages in the same frame (line
in Ethereal) as the message you wanted to get with the filter?
If yes, then this is because of
- traffic between several nodes on the same link _and_
- SCTP bundling - which can group several M3UA packets in one
As Ethereal filters act on a per packet basis, I don't know
how you could "fix" that, except having an option to display SCTP
bundled messages as different packets.
For reference, here is a short capture with SCTP/M3UA/SCCP/TCAP/Camel
(ITU)
where frames are bundled (this is no live traffic, but coming from
the Seagull test tool (http://gull.sourceforge.net/).
For example, filtering on TCAP TID "tcap.tid == 16:94" will display
The message with tid=1694 as well as messages with other tids that
are sent in the same IP frame.
Olivier.
HP OpenCall Software
Attachment:
camel_itu_sctp_bundled.pcap
Description: camel_itu_sctp_bundled.pcap
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users
