I've got following situation in one frame in my capture file
I want to extract information from
But what I got was a data from How to write a tap to make it possbile to get asked 15 May '12, 12:18 tciops showing 5 of 8 show 3 more comments |
One Answer:
If I understand the problem correctly, you're trying to fetch the last instance of
answered 16 May ‘12, 04:50 helloworld Thanks helloworld. It’s almost the thing I wanted to get. If I change just a little the order of data in frame to look like this:
I would get last SCCP info and the CAP info I want. I need data from CAP and SCCP which encapsulates this CAP packet (using TCAP). So, I guess I will have to somehow master this looping proposition. I just need to compare it with (16 May ‘12, 06:05) tciops |
Please post a sample capture at http://cloudshark.org
capture contains data which I don't want and am not allowed to send - real user traffic with all confidential data
Cannot post it anywhere sorry...
you could select 3-4 packets with no "compromising" data in it.
All I can do is post you a text representation of this frame without any vulnerable data Unless you know a way to modify a pcap file to change this data
you can try this: http://sourceforge.net/projects/powereditpcap/ or any HEX editor, if you know exactly what data to change. Beware to not change the header data.
BTW: can you post the whole dissector code? If that's not the case, I think it will be hard to help.
It's not possible to post it or even attach it here so here is the link http://cdn.anonfiles.com/1337162613946.txt
powereditcap doesn't know how to edit SS7 protocols I gave up, it's not that easy and it's not so urgent frame txt http://cdn.anonfiles.com/1337164422323.txt
It's hard to test the Lua Tap with the text file. Can you please upload the same information in binary form (pcap) to cloudshark (or if you like to anonfiles.com).