Re: Patch for mtp2 filtering

[Guy Harris <guy () alum mit edu>]

Florent.Drouin () alcatel-lucent fr wrote:

> Here is a short patch to implement filtering for MTP2 frames on SS7.
> You can now use "fisu", "lsu", or "msu" to filter the MTP2 messages at
> libpcap level.
> In most of the case, the filter to use will be "!fisu", to have only the
> significants frames.

I checked it in (one of the versions you sent managed to make it through 
your mail system, as per my other messages), with some cleanups.  It's 
in both the main and x.9 branches.

> Additionaly, ou can use the already existent filters for MTP3
> like "opc 9646 or dpc 9646"

It looks as if they don't work with DLT_MTP3 captures, as, for DLT_MTP3, 
off_sio, etc. aren't set.  I'm not sure whether any capture device uses 
DLT_MTP3, however, so that might not ever have been tested.

> The patch is based on libpcap-2006.12.13, with diff commands, but not from
> the cvs release.

Unfortunately, that made it a bit difficult to apply; I applied it to 
top-of-tree CVS, and had to manually fix it up, as the line numbers had 
changed.

"diff -c" and "diff -u" avoid that problem - the patches can usually be 
applied to versions of the software to which changes have been made 
since the patch was made.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.