Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re : MATE & Radius issue

[LEGO <luis.ontanon@xxxxxxxxx>]

On 10/13/05, Michael Kopp (News) <mk.news@xxxxxxxxxx> wrote:
> BTW : is it possible to make Gog of Gogs ? so one layer more ?
> I`m playing around with makeing a mate filter for grouping together GTP
> messages (between SGSN and GGSN) + Radius + user traffic
> Seems due to the fact that I have different TEIDs for the different
> directions (SGSN->GGSN / GGSN->SGSN / TEID=0 for Create PDP Ctx) , a little
> be complicated to group them together.

I've thought of it for a while and I think you might want to have two
types of Pdus for each GTP flow using Pdu's Criteria and LastPdu. Then
have a Gop of each direction (gtp_up and gtp_down) and after that Gog
them toghether with the Radius Gop.

Pdu gtp_ul_pdu ... {
...
Criteria Accept Strict (ip_src=ggsn_addr);
LastExtracted True;
};

Pdu gtp_dl_pdu ... {
...
Criteria Accept Strict (ip_src=sgsn_addr);
LastExtracted True;
};

L.

--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan