RE: [Ethereal-users] Dissect Sigtran capture files

["Jacques, Olivier (OpenCall Test Infra)" <olivier.jacques@xxxxxx>]

> The ethereal display filter will only select 
> large ( containing many disparate MTP3 messages) ethernet frames.
>
> When I filter on "MTP3 msg xyz between node NE1 and NE2" (as 
> specified by M3UA DPC), I get selected frames containing indeed 
> the desired xyz  but also 95% other MTP3/M3UA/SCTP messages 
> from all over the place I am not really interested in.

Are those additional messages in the same frame (line
in Ethereal) as the message you wanted to get with the filter?

If yes, then this is because of 
- traffic between several nodes on the same link _and_
- SCTP bundling - which can group several M3UA packets in one

As Ethereal filters act on a per packet basis, I don't know 
how you could "fix" that, except having an option to display SCTP
bundled messages as different packets.

For reference, here is a short capture with SCTP/M3UA/SCCP/TCAP/Camel
(ITU)
where frames are bundled (this is no live traffic, but coming from 
the Seagull test tool (http://gull.sourceforge.net/).
For example, filtering on TCAP TID "tcap.tid == 16:94" will display
The message with tid=1694 as well as messages with other tids that
are sent in the same IP frame.

Olivier.
HP OpenCall Software

Attachment: camel_itu_sctp_bundled.pcap
Description: camel_itu_sctp_bundled.pcap