Re: Mutliple m3ua messages in one frame

["j.snelders" <j.snelders () telfort nl>]

Hi Milan,

Which version are you using?

The latest versions have the option -E occurrence=f|l|a to print the first,
last or all occurences of each field.

$ tshark -r malta.pcap -R 'frame.number > 1005 && frame.number < 1015' -T
fields -e m3ua.protocol_data_opc -e m3ua.protocol_data_dpc -E occurrence=a
8455    6137
6137,6137,6137  8455,8455,8455
6137    8455
8455    6137
6137,6137       8455,8455

8455    6137
6137    8455
8455    6137

More information:
tshark -h
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as aggregator
     quote=d|s|n           select double, single, no quotes for values

BTW
I'm using version TShark 1.5.0-SVN-34549 on Windows.

Best regards
Joke

On Thu, 21 Oct 2010 10:01:39 +0200 Milan STANCIC wrote:
> Hello
>
> Can somebody to help me ?
>
> I got some simple problem maybe you can help me...
>
> Exactly, I should extract m3ua/sccp/tcap/gsm_map/gsm_sms payloads from
> frame for purpose of collection of CDR's.. Problem is in case when you
> got in one frame more than one m3ua message, Tshark give us just one
> line, last one. please symptoms.
>
> ---------------------
> root@milan-PC:/home/milan/Downloads# tshark -R 'frame.number == 1010' -e
> frame.number -e m3ua.protocol_data_opc -e m3ua.protocol_data_dpc -r
> malta.pcap  -Tfields
> Running as user "root" and group "root". This could be dangerous.
> 1010    6137    8455 ----//// it is just last m3ua message
> -----------------------------------------
>
> So, I have tried next:
> to use MATE: please see config file...
>
> wireshark -o "mate.config: m3ua_v04.mate" -r malta.pcap
>
> There is two MATE section but not each of wanted attributes.. please see
> mate_example.png and m3ua_v04.mate
>
> PLEASE HELP, HOW CAN I PROCESS IT.
>
>
> -- 
> Milan STANCIC
>
> System Administrator
>
> RoutoMessaging
> http://www.routomessaging.com
> GSMA Associate Member
> Tel +44 (0) 870 231 7777
> Fax + 44 (0) 870 231 7771
>
>
>
> This email contains Routo Telecommunications information, which may be privileged
> or confidential. It's meant only for the individual(s) or entity named above.
> If you're not the intended recipient, note that disclosing, copying, distributing
> or using this information is prohibited. If you've received this email in
> error, please let me know immediately on the email address above. Thank
you.
> Routo Telecommunications Limited Registration Number 04546322 having its
> principal place of business at 48 Charlotte Street, London, W1T 2NS, United
> Kingdom
>
>
>
> Internet communications cannot be guaranteed to be timely, secure, error
> or virus-free. The sender does not accept liability for any errors or omissions.
>
>
>
> We monitor our email system, and may record your emails.
>
>
>
>
>
>
> Bijlage: m3ua_v04.mate
>
>
> Bijlage: mate_example.png
>
>
> Bijlage: Screenshot.png
>
>
> Bijlage: malta.pcap

       


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe