This is our old Q&A Site. Please post any new questions and answers at

I try to analyze ISDN data which contain SAPI 16 packet data, which is X.31. X.31 data is X.25 packet data (layer 3). So far I know, wireshark can decode X.25, but if I select the data field, I cannot decode it since Decode as is not available (grayed out). The layer 2 LAPD data is displayed correctly, the address field SAPI is also correctly displayed as "X.25 Level 3 procedures (16)", but the content of the I field is not decoded. Does it be possible to tell wireshark somehow, that a I field on a LAPD frame with SAPI 16 has X.25 content ?

asked 19 Jul '12, 02:33

pingus's gravatar image

accept rate: 0%

It seems that the X.25 dissector doesn't register itself with the LAPD dissector for this SAPI. I'm not sure why. You could/should register a bug for this at, attaching a sample capture file showing this, so it can be addressed.

permanent link

answered 19 Jul '12, 04:59

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Thanks for the hint, I did this and I also added a quick patch I did to decode the LAPD X31 traffic as X.25. It would better if somebody with more knowledge about wiresharks internals to add X.31 as variant of X.25, but with the patch it works for me well enough.

(22 Jul '12, 10:35) pingus

For reference the bug is 7514.

(22 Jul '12, 12:31) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Jul '12, 02:33

question was seen: 2,374 times

last updated: 22 Jul '12, 12:31

p​o​w​e​r​e​d by O​S​Q​A