This is our old Q&A Site. Please post any new questions and answers at


I got a pcap with a SLL capture, I figure that's a GSM SMS capture, but I m not totally sure. Anyways, I m trying to force wireshark to read it as a GSM SMS but I didn't success.

I need to reform the headers ? I mean to change the Frame / Linux cooked capture headers ? Moreover, the Linux cooked capture layer got an unknow protocol (0x00f5). Or can I just enforce a protocol about the wireshark reading ?

asked 04 Nov '15, 01:05

V1shn0u's gravatar image

accept rate: 0%

edited 04 Nov '15, 02:48

The unknown protocol refers to Nokia Phonet frames, according the the Linux kernel sources (include/uapi/linux/if_ether.h). Wireshark currently doesn't understand these frames.

You could file an enhancement bug, attaching this capture file, and if possible a reference to the Nokia Phonet Frame format, as found include/uapi/linux/phonet.h, so that it can be implemented.

permanent link

answered 04 Nov '15, 02:17

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Do you know a software able to read theses frames ?

I will file an enhancement bug.

(04 Nov '15, 03:10) V1shn0u
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 Nov '15, 01:05

question was seen: 2,320 times

last updated: 04 Nov '15, 03:10

p​o​w​e​r​e​d by O​S​Q​A