This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

ISDN HEX capture analyze

0

I have a Hex Dump of ISDN messages and I wonder if Wireshark can be used to decode those messages. Here an example of what I have:

0000  02 01 01 a5                                          
0000  02 01 01 b9                                          
0000  02 01 01 a5                                          
0000  02 01 01 b9                                          
0000  00 01 a4 b8 08 02 00 3e 05 04 03 80 90 a2 18 03   
0010  a9 83 85 6c 0c 21 80 38 30 31 38 30 32 33 30 30   
0020  30 70 08 c1 33 37 33 39 31 32 30                   
0000  00 01 01 a6                                          
0000  02 01 b8 a6 08 02 80 3e 02 18 03 a9 83 85         
0000  02 01 01 ba                                          
0000  02 01 ba a6 08 02 80 3e 01 1e 02 82 88            
0000  02 01 01 bc                                          
0000  02 01 bc a6 08 02 80 3e 07                         
0000  02 01 01 be                                          
0000  00 01 a6 be 08 02 00 3e 0f                         
0000  00 01 01 a8                                          
0000  00 01 a8 be 08 02 00 3e 45 08 02 8a 90            
0000  00 01 01 aa                                          
0000  02 01 be aa 08 02 80 3e 4d                         
0000  02 01 01 c0                                          
0000  00 01 aa c0 08 02 00 3e 5a                         
0000  00 01 01 ac                                          
0000  02 01 01 ad                                          
0000  02 01 01 c1                                          
0000  02 01 01 ad                                          
0000  02 01 01 c1

I've try to use text2cap command but wireshark couldn't decode the ISDN messages. The command used was text2pcap.exe -s 273,819,1 TXT.file CAP.file

Is there a way to make it work ?

Thank you

Marcelo

asked 23 Sep '11, 09:01

MOVnet's gravatar image

MOVnet
1112
accept rate: 0%


One Answer:

2

You need to specify a data link type of 203 (see pcap/bpf.h). Try text2pcap -l 203 file.txt file.pcap.

answered 23 Sep '11, 10:01

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Great! Problem solved! Thank you very much !

(23 Sep '11, 11:46) MOVnet