Can you please let me know camel IN flows. I have access to pcap files from telecom operators and Im able to see various eventTypeBCSM in one camel frame. for example: oAnswer, oDisconnect, oDisconnect, routeSelectFailure, oCalledPartyBusy and oAbandon are all in a sequence in one camel frame. Is it possible? can you please point me to other such scenarios? Also I need to extract the calling and called party numbers from the same. Im using wireshark/tshark to parse the file. Eventually I need to use Tshark continously on IN servers on live traffic. Your help will really give a kick start. asked 19 Jul '15, 05:32  Karan Grover converted to question 19 Jul '15, 12:19  grahamb ♦ |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Karan, please ask your question in a new thread rather than posting a question inside a question thread that is a few years old. It helps keep the Q&A board more organized.
I converted the item to a new question.
Hi guys,
Any help will be useful here. Im able to understand the camel flow however I still need to understand that If I can use tshark continously reading from the network card? There are 2 questions here:
1) Will tshark die after sometime due to memory problems? Although I read few topics here that said for some users tshark ran for months especially on TCAP and CAMEL protocols because tshark doesnt create any maps in memory for these protocols.
2) Will tshark be fast enough to read all packets from network card? There will be very high traffic on my application server because all call data for the operator are mirrored on this server.
Im using the following command to capture data, with input file (-r) its too slow so Im worried about the performance when using with ehternet card.
tshark -Tpdml -Y "camel.InitialDPArg || (camel.EventReportBCSMArg && (camel.eventTypeBCSM==4||camel.eventTypeBCSM==5))" -r "\home\usr0121\hcm.dump"