Wireshark-users: Re: [Wireshark-users] Question about parsing raw MTP3
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Florent.Drouin@xxxxxxxxxx
Date: Wed, 4 Oct 2006 17:21:33 +0200
      Hello


If you have converted your data with text2pcap, you can define the link
layer with the -l option
ex: text2pcap -l 141 data.txt data_mtp3.pcap
So, wireshark will decode as raw mtp3

Regards
Florent

<<
I have taken some raw SS7 MTP3 data from our application and have converted
it to pcap format. Wireshark is able to pull this file in, but it is
looking at it as if it was Ethernet. It is expecting the first six octets
to be the MAC address, etc. It is MTP3 data, starting with the SIO octet,
then the two 24 bit point codes, then the SLS, etc.





Is it possible to tell wireshark, "interpret this as MTP3 and don't worry
about there not being any link-level (or lower) data"





I'm thinking there has to be a way of short circuiting the lower layer
dissectors. Any help is appreciated. Thanks in advance.


>>