Wireshark-dev: Re: [Wireshark-dev] Decode MTP3 message
From: Martin Kaiser <[email protected]>
Date: Fri, 24 Feb 2012 13:51:42 +0100
Thus wrote Anya Verizi ([email protected]):

> Can anyone know how I can decode MTP3 message? For example I put code
> in txt file and then to pcap (text2pcap -l 141 file.txt file.pcap
> ), but when I open it in wireshark I got malformed packet:ISUP? Do I
> )must put some in txt file before?

in the input file for text2pcap, each line must start with an offset
e.g. if your packet contains 0x1 0x2, the input line for text2pcap should be

000000  0x01 0x02

can you run tshark -r <your pcap file> -V -x and post the output for one
malformed packet?