Wireshark · Ethereal-dev: Re: [Ethereal-dev] using MATE to detect SCTP retransmissions

[Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>]

Hi Jeff,

sometimes the graphical analysis stuff from Statistics/SCTP helps...

Best regards
Michael

On Nov 11, 2005, at 17:14 Uhr, Jeff Morriss wrote:

> I've got a huge capture file with lots of SCTP retransmissions.  I'd 
> like to have an easy way to find them and (since we don't have SCTP 
> analysis similar to the TCP analysis yet) I started playing around 
> with MATE.
>
> From reading the docs I thought I could create a Gop of SCTP PDUs 
> whose only matching criteria was the Vtag and TSN, something like:
>
> Pdu sctp_pdu Proto sctp Transport ip {
>         //Extract addr From ip.addr;
>         //Extract port From sctp.port;
>         Extract vtag From sctp.verification_tag;
>         Extract tsn From sctp.data_tsn;
>         Extract sctp_chunk From sctp.chunk_type;
> };
>
> Gop sctpretrans On sctp_pdu Match (vtag, tsn) {
>         Stop(sctp_chunk=6);
> };
>
> Done;
>
> (I've already filtered the file down so there's only my association in 
> there.)
>
> MATE picks up the sctp_pdu's but not the Gops.  Any ideas why?  Any 
> ideas for a better way to do it?  (I want to find the retransmissions 
> and check the time between the transmissions.)
>
> (I also tried not having any Start or Stop conditions to the Gop but 
> the parser didn't like that thus the basically useless--for what I'm 
> trying to do--Stop condition.  Really, my Start condition is that the 
> PDU matched and my Stop condition is the end of the capture file.)
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev