This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to filter out tcap location update messages

0

Hi All,

I want to filter out these wireshark messages. They are always coming, does anyone know how to filter below messages out?

*GSM MAP invoke subscriberLocationReport

GSM MAP returnResultLast subscriberLocationReport

GSM MAP invoke provideSubscriberLocation*

asked 09 Oct '12, 10:35

omer's gravatar image

omer
6114
accept rate: 0%

edited 09 Oct '12, 10:35


One Answer:

1

In general if you want to filter out something, find the thing you're interested in (e.g., subscriberLocationReport) in the decode tree, right-click on it, and select "Apply (or "Prepare") as filter" and then select "Not selected."

For an updateLocation (sorry, I couldn't easily find any examples of the messages you mentioned), the resulting filter is:

!(gsm_old.localValue == 2)

Of course you can build up more complicated filters like this (which filters out updateLocation and updateGprsLocation):

!(gsm_old.localValue == 2) && !(gsm_old.localValue == 23)

To find these values in a GSM message, look here:

GSM Mobile Application
    Component: invoke (1)
        invoke
            invokeID: 15
            opCode: localValue (0)
                localValue: updateLocation (2) <<< right-click on this field to filter out updateLocations

answered 10 Oct '12, 13:47

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%