This is a static archive of our old Q&A Site. Please post any new questions and answers at

how to display s1ap.gTP_TEID as decimal format?


how to display gtp-teid as decimal format? s1ap.gTP-TEID: d7e29a65

asked 16 Oct '13, 16:01

ertsali's gravatar image

accept rate: 0%

edited 18 Oct '13, 03:13

Kurt%20Knochner's gravatar image

Kurt Knochner ♦

2 Answers:


how to display gtp-teid as decimal format? gTP-TEID: d7e29a65

for that single value: 3621952101

In General: By adding a Lua post dissector that takes the original value and adds a new field for the decimal value.

Here is a very simple (but working) sample code, based on the DnsCat Lua post dissector

File: gtp_ext.lua

-- info
print("gtp postdissector loaded")

– we need these fields from the gtp packets gtp_teid ="gtp.teid")

– declare our postdissector gtp_pd = Proto("gtp_ext","gtp TEID decical converter postdissector")

– our fields gtp_teid_decimal = ProtoField.uint32("gtp.teid_decimal","GTP TEID in decimal format") gtp_pd.fields = {gtp_teid_decimal}

– dissect each packet function gtp_pd.dissector(buffer,pinfo,tree) local gtpteid = gtp_teid()

if (gtpteid) then subtree = tree:add(gtp_pd,"GTP decimal data") subtree:add(gtp_teid_decimal,tostring(gtpteid)) end end – end dissector function

– register ourselfs register_postdissector(gtp_pd)

Place the file gtp_ext.lua (gtp_ext == extended GTP) in the Wireshark installation directory. Then edit init.lua. Add the following line:


Close Wireshark and open it again. Open a GTP pcap and filter for


All frames with a gtp.teid will have a new field called


You can also use the new field in a display filter, like this:

gtp.teid_decimal > 10000000 or gtp.teid_decimal eq 200000

See the following screenshot

alt text

Have fun!


answered 17 Oct ‘13, 07:41

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 17 Oct ‘13, 09:23

Thanks.. this is awesome but I would like to decode s1ap.gTP_TEID. Please help to modify the coding based on s1ap.gTP_TEID.

(17 Oct ‘13, 15:27) ertsali

Basically: Just replace the string ‘gtp.teid’ in the code with ‘s1ap.gTP_TEID’. Unfortunately I don’t have pcap file with s1ap traffic to test it.

new code:

– info
print("gTP_TEID postdissector loaded")

– we need these fields from the gtp packets s1ap_gtp_teid ="s1ap.gTP_TEID")

– declare our postdissector teid_pd = Proto("teid_decimal","s1ap gTP_TEID decical converter postdissector")

– our fields s1ap_gtp_teid_decimal = ProtoField.uint32("s1ap.gTP_TEID_decimal","S1AP gTP_TEID in decimal") teid_pd.fields = {s1ap_gtp_teid_decimal}

– dissect each packet function teid_pd.dissector(buffer,pinfo,tree) local s1apgtpteid = s1ap_gtp_teid()

if (gtpteid) then subtree = tree:add(teid_pd,"gTP_TEID decimal data") subtree:add(s1ap_gtp_teid_decimal,tostring(s1apgtpteid)) end end – end dissector function

– register ourselfs register_postdissector(teid_pd)

(18 Oct ‘13, 03:11) Kurt Knochner ♦
(19 Oct ‘13, 02:23) ertsali

O.K. with s1ap it’s not that simple, as there can be several gtp_TEID fields in one frame. So, it’s unclear how the post dissector should show them? Just in the same order as they appeared in the original frame, one after the other?

(21 Oct ‘13, 03:41) Kurt Knochner ♦

I see. Thanks

(21 Oct ‘13, 21:19) ertsali

Kind of speaking to Kurt’s last question, is there a specific end goal in mind here ertsali? Are you trying to correlate the trace file with MME queries, for example? Easy enough to use the above method to just display all the TEIDs, and if also bound to a procedure code I believe the order should always be predictable as well, unless the vendor is doing something odd like passing separate S1AP commands as data chunks in a single packet.

There’s probably easier ways depending on the end goal though. For example, converting the other way from a vendor’s stat file might just be a one-liner script as opposed to breaking out Lua to map Wireshark to the format of a stat or log file.

(21 Oct ‘13, 21:25) Quadratic
showing 5 of 6 show 1 more comments


By changing the code in packet-gtp.c, otherwise you have to bring out your calculator.

answered 17 Oct '13, 07:27

Anders's gravatar image

Anders ♦
accept rate: 17%