On Thursday 15 July 2004 09:29, Guy Harris wrote:
> On Wed, Jul 14, 2004 at 10:17:22PM +0200, Willem Dekker wrote:
> > What our company (mBalance) is doing is the following.
> > Tap the packet from the ss7 stack (lowest level possible), write it to a
> > file. Then have a small perl script to convert this to the pcap format.
>
> Why not either
>
> 1) write to the file in pcap format
>
> or
>
> 2) contribute code to Ethereal to read the format you're writing
>
> and avoid the Perl script step entirely?
You are absolutely correct that the proper way is to either write the c code
to let Ethereal read the trace files or alternatively to write in pcap format
the latter option would mean that we loose some of the information that is
available and can be useful like the physical trunk (interface) and timeslot
information of the T1/E1. The perl script is just a quick hack.
With regards Dimitar question of to capturing the packets, what we use is we
augmented the routine that reads the packets from the MTP2 layer to write
each packet to a socket / file with a small header containg the time,
direction (RX/TX), timeslot and trunk information.
The same way in the routine for handing over packets to the MTP2 layer for
writing. This approach assumes that you have the source code for the SS7
stack.
In the SS7 stack we just write to a file handle, another routines take care of
opening either a file or a socket (to allow remote tracing), and closing the
socket of course.
You can image adding a simular engine like bpf /pcap wiretapping to allow
filtering already on the traced packets.
I am not familiar with septel cards. So I don't know what kind of facilities
they offer for tracing. If you have an SS7 stack in source code, you can do
the approach outlined above. Otherwise you are in for either some serious
lowlevel hacking (with reverse engineering and patching code at the
appropriate places), or maybe you can place a card into high-impedance mode
and can let that card with a special cable feeding to two RX interfaces read
the traffic and send it to your tracer.
Best regards,
Willem Dekker
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
