Wireshark-bugs: [Wireshark-bugs] [Bug 9455] dissect rf5 file (k18) of tektronix
Date: Wed, 20 Nov 2013 09:57:31 +0000

Comment # 4 on bug 9455 from
(In reply to comment #3)
> Please find attached the entire file compressed .

Thanks!

> where can i find the event group value,

In whatever documentation Tektronix has for their file format.  They might not
have any such documentation other than a document they have internally (or,
worse, other than the source code for whatever software they have that reads
those files).

> and what does this means ?

At

    http://www.tek.com/manual/record-file-api-programmer-manual

there is a document that describes an API of some sort that can be used to read
and write RF5 files *only on Windows* (so the API is useless for Wireshark,
which has to be able to read those files on *all* platforms, including a large
number of UN*Xes).

It describes *some* of the record formats in RF5 files, although it doesn't
describe the file format completely.

It doesn't describe the record type we're seeing in your capture file; those
records appear to be records containing frames, but they're different from the
records described in the documentation.

(You will have to create an account on the Web site if you want to download
that document.)

Those records *appear* to have an ATM VPI/VCI associated with them.  If you
read that file with Tektronix's software, what does it report as the VPI/VCI
for the frames, if it reports a VPI/VCI pair?  Does it report any other
information other than that it's an IP packet (with SCTP, M2UA, MTP3, and ISUP
atop that)?


You are receiving this mail because:
  • You are watching all bug changes.