Wireshark · Ethereal-users: Re: [Ethereal-users] GTP and TCP analysis

[Guy Harris <guy@xxxxxxxxxx>]

On Mon, Apr 07, 2003 at 12:04:09PM +0200, Pierre Eisenmann wrote:
> I am using Ethereal to analyse GTP data. My issue is that I cannot analyse
> TCP traffic within the GTP tunnel although the content of the GTP traffic is
> TCP. If I choose "follow TCP stream" it works. If I launch tcptrace it tells
> me "selected packet is not a TCP segment"

I can't speak for tcptrace, as it's not our program, it's Shawn
Osterman's program:

	http://www.tcptrace.org/

but it might be assuming that there's no tunneling involved, so it might
not support GTP-over-TCP.

The Ethereal TCP Stream Analysis function, unfortunately, currently
makes the same assumption; were somebody to rewrite it using the tap
mechanism and the tap recently added to the TCP dissector, as I suspect
would be possible, that limitation could probably be removed.