Re: [Ethereal-users] creating a PCAP file from unencapsulated MTP3 traces

[Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>]

Hi Luis,

for MTP2 it is very simple. You can just have the MTP2 message
as the packet in a libpcap file with DLT value of 140. If you put

0000 77 77 00
0000 77 78 01 02
0000 77 79 02 03 04

in a file with name mtp2.txt with the command

text2pcap -l 140 mtp2.txt mtp2.pcap

you can process it with ethereal.

If you put MTP3 packets in the file you need to
use the -l 142 option.

I hope this helps.

Best regards
Michael

On May 5, 2005, at 4:33 PM, LEGO wrote:

> Hi,
> I got MTP3 messages taken directly from a trace in a network element
> (just unencapsulated MTP3 with timestamps). I'm writing a script to
> import these into ethereal.
>
> I've already created a script that fits the mtp3 message over
> m3ua/sctp/ip/eth but I find it cumbersome to add that much data to
> decode mtp3 and it's payload since I noticed Wiretap has already an
> mtp2 "encapsulation".  So far I haven't been able to figure out which
> format to use.
>
> How the MTP2 file is formatted?
>
> Thanks,
>
> Luis
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users