Wireshark · Ethereal-dev: [Ethereal-dev] Encapsulation formats for MTP3 or M3UA?

[Thomas Steffen <steffen.list.account@xxxxxxxxx>]

Hi,

I use Ethereal to dissect MTP3 and M3UA messages, that are captured
just above the MTP2 and the SCTP layer. I can read a trace of MTP3
packets directly, if I use the protocol value 0x8d or 141 (thanks
Micheal for the hint). However, I have more data available (direction,
destination etc) that I would like to encode in the trace, too. Is
there an existing encapsulation protocol that I can use?

I think the inux cooked capture header is very close to what I want,
and I could imagine using it for this purpose. However, I have not
discovered how I can specify the protocol type in this format. It
seems to implicitely expect IP packet. Any idea how to change that?

And if that is not possible, what are my other options? I could add a
"fake" MTP3 layer, of course, but it is still difficult to encode the
available data there. For M3UA packet, adding the IP/SCTP header might
be more work, but it would nicely fit all the data I have, with the
expection of the direction.

Thomas