ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] How to select some bytes inside a packet

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 22 Sep 2008 12:57:52 -0400

(In this case you're using M3UA not SUA, but it's almost the same.)

So, if I understand you correctly you want to copy the DLR value out of the SCCP portion of this message? What about right-clicking on the DLR in the middle pane and selecting "Prepare as filter" or "Apply as filter"? If you really only want the DLR's value you could also (by right-clicking) "Copy" as various things (for example, "Bytes (Hex Stream)").

Or is that not what you're looking for?

BARILLY YANN wrote:
Yes I mean SUA (SIGTRAN for signaling transport), to be more precise RANAP protocol in my case I have linked a packet in a .pcap file and a screen of what I see (slightly different).

And my question is : in my packet, how can I copy the destination local reference in a string in order to use it afterward ?

Thanks

Yann

PS missed the files ... sorry <<RANAP_Network_failure.pcap>> <<RANAP_Network_failure.jpg>>

Message: 5
Date: Wed, 17 Sep 2008 11:53:39 -0400
BARILLY YANN wrote:
 > Hi,
 >
 > my goal is at least to implement statistics for SIGTRAN as we can find
 > for GSM.
 >
 > I'd like to select the destination local references (dlr), once I have
 > found a network failure and apply this sccp.dlr as a filter.
 >
 > I know how to find a packet that mentions the network failure, and how
 > to apply the filter. But I'm not able to select the sccp.dlr out of
 > clicking on it... that's not realy powerfull for an automated function!

When you say SIGTRAN do you mean SUA or...?

When you say a network failure, do you mean a COREF (SUA) or...?

A single-packet example capture might help me understand what you mean.