This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

gsm_a vs e212

0

Hi, I use Wireshark to convert gsmtap pcap's to pdml. An example line from pdml file is shown below. I have a few questions about the way Wireshark converts pcap to pdml.
I have two computers, one is running Wireshark 1.12 and the other is running Wireshark 1.99. Now, Wireshark 1.12 saves this line as shown below, Wireshark 1.99 would save it differently. The field "name" would be "e212.lac", the value in field "show" would be shown decimal and not hex.
I had several scripts extracting the info from pdml file based on values in the field "name". With Wireshark 1.99 it all becomes useless, as the unique field values I was using changed the contents. Is there a way to run Wireshark 1.99 in such away that pdml files are backwards compatible? I do the pcap to pdml conversion this way:

tshark -r abc.pcap -Y '!icmp && gsmtap' -T pdml -2 -R "gsm_a.dtap.msg_rr_type == 0x21" > abc.txt

field name="gsm_a.lac" showname="Location Area Code (LAC): 0xe54c (58700)" size="2" pos="66" show="0x0000e54c" value="e54c"

asked 22 Oct ‘15, 02:27

dictador's gravatar image

dictador
6112
accept rate: 0%


One Answer:

1

Unfortunately there is no way to have backward compatibility. The new filter name allows to extract the info from various protocols at the same time, but as the drawback of breaking existing scripts. Sorry about that.

answered 22 Oct '15, 03:23

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%