At the moment we are using tshark (v2.0.3) to extract specific parameters from GTP traffic. in some cases when the value for mnc is 01 tshark returns 1 which technically is not equal to 01, the thing is in wireshark we can see the correct value from proto tree tshark command:
and in PDML exportو we can see correct value (f210) in Value attribute, but it seems -T field command is returning values found in Show attribute.
Is there any argument or configuration forcing tshark to extract raw values? asked 08 Jun '16, 04:01 hja |