This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi Guys,

I'm trying to open a TCAP ANSI trace that is over MTP-2, but Wireshark decodes the lower layers (MTP-2 and MTP-3) as Ethernet. I tried to force the decode to MTP-2 using "Decode As..." but couldn't find such option.

Below you can an example:

c0 af 28 83 22 73 02 02 e6 e1 0b 09 80 03 05 0a

02 c1 0b 05 c3 08 02 e6 e1 11 e4 0f c7 04 04 00

0b 6c e8 07 ea 05 cf 01 01 f2 00 40 a4

Does anyone know the reason for this?

asked 10 Apr '12, 12:48

fertonin's gravatar image

fertonin
1111
accept rate: 0%


If this is a pcap or pcap-ng trace, the reason is probably that somebody put the wrong link-layer header type value in the capture file header (for pcap) or Interface Description Block for the interface (for pcap-ng).

Wireshark has no "Decode As" for overriding the link-layer header type, because that's not something that's supposed to be wrong. For pcap files, you could try using editcap to forcibly change the link-layer header type value, for example:

editcap -T mtp2 {bad capture file} {name for new capture file}

where {bad capture file} is the pathname of the file you're trying to open and {name for new capture file} is the pathname for the location where you want the fixed capture file to be put. If you can successfully read the new capture file, you can just replace the old capture file with the new one.

permanent link

answered 10 Apr '12, 15:33

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Thanks a lot Guy, it worked, I ran the suggested command and was able to see the decode.

(11 Apr '12, 13:53) fertonin

So how was that trace produced? Whatever produced it put the wrong link-layer header type in the file, and should probably be fixed to use the right link-layer header type, so the files can directly be read by, for example, Wireshark.

(11 Apr '12, 14:06) Guy Harris ♦♦

I have a pcap file with both ISUP over MTP-2 packets and ISUP over IP (Ethernet) packets. From what I understand the -T mtp2 is global for the whole packets in the pcap file. Is there a way to set the link-layer type for a packet?

(04 Oct '12, 03:08) Erez

I have a pcap file with both ISUP over MTP-2 packets and ISUP over IP (Ethernet) packets.

The pcap file format has only a per-file link-layer type, so it can't handle files with a mixture of MTP2 packets and Ethernet packets. Whoever chose to write it out as a pcap file made a mistake by doing so; they should have used pcap-NG format instead.

You'd probably have to write your own tool to read the file, somehow figure out or be told by the user which packets are Ethernet packets and which packets are MTP2 packets, and write out a pcap-NG file.

(04 Oct '12, 11:18) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×89
×2

question asked: 10 Apr '12, 12:48

question was seen: 4,315 times

last updated: 04 Oct '12, 11:18

p​o​w​e​r​e​d by O​S​Q​A