Wireshark · Ethereal-users: Re: [Ethereal-users] Display Filter issues for TCAP and MTP3

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Andreas Fink wrote:
> Hello,
>
> I'm trying to do a display filter to include a specific TCAP transaction 
> ID which in my example is hex 040F (its displayed like this in the tcap 
> dissector). When I do tcap.id == "040F" it is not being accepted. The 
> dialog to enter this hints me to the fact that only a  one byte 
> numerical value is being allowed. this would be wrong as transaction 
> ID's can be one or two bytes.

Hmmm, "tcap.identifier" is registered as FT_BYTES which appears to mean 
you need to use a filter like "tcap.identifer == 04:0f".

> Similar problem I'm having if I try to filter using mtp3 pointcodes. 
> They are displayed in ITU format X-XXX-X but I cant enter them like 
> this, I must enter them in 14 bit numerical value (which requires 
> external translation by hand).

They should also be displayed on decimal, at least in the MTP3 dissector 
(something like "Originating Point Code NNNN (X-XXX-X)".

Yes, this is one of the problems with the dissection of MTP3 point 
codes: the structured MTP3 point code string is only appended to the 
point code item, it is not added as a filterable field (except in ANSI 
and China ITU where the PCs are always formatted as a 8-8-8 string). 
(Another problem is that not all dissectors show you the structured format.)