We're now a non-profit! Support open source packet analysis by making a donation.

Wireshark-users: Re: [Wireshark-users] How to view rf5 files

From: "Billie Chan" <[email protected]>
Date: Thu, 20 Sep 2007 14:56:40 +0800
 I have a sample K15 capture it's ATM over IP over GTP. But I can fully
decode it. Would you please advice how to decode it.

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Luis EG
Sent: Thursday, August 16, 2007 5:32 AM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] How to view rf5 files

You can edit the 'K12 Protocols' table from

Click on preferences .
expand the protoocols tree.
scroll down until K12xx
click on K12xx
click on [Edit Table...]

In the protocols table,
click [New] to create a new binding
a "new" window will open
in "match" you put a unique part of the stack file e.g.: "v34_telcel_2"
in "protocol" you have to write the lowest layer protocol in the file (
"eth_withoutfcs" for ethernet, "mtp2" for mtp2, "x25" for X.25, "fr"
for frame-relay ).

BTW: If you have  files containing X.25 or ANSI MTP2 I'd really
appreciate if you sent me a small one (of each), I have neither X25 nor
MTP2 ANSI  files and that'd be good for testing.


On 8/15/07, Segura, Miguel - Acision <[email protected]> wrote:
> Hello,
> I tried to view rf5 files on wireshark and I got the following:
> The question is how can I edit the k12 protocols table in order to be
able to view the packets properly?
> In this packets there are some smpp packets that I would like to see.
> Any advices will be appreciated.
> Kind Regards,
> Miguel Segura
>  Senior Operations Engineer
>  ________________________________________
> Acision. Innovation. Assured.
>  www.acision.com
> 6404   International Parkway, Suite 2048
>  Plano, TX 75204
>  T:  +52  55 5254 4718
>  M: +52  155 1798 6674
>  E:  [email protected]
>  This e-mail and any attachment is for authorised use by the intended
recipient(s) only. This email contains confidential information. It
should not be copied, disclosed to, retained or used by, any party other
than the intended recipient. Any unauthorised distribution,
dissemination or copying of this E-mail or its attachments, and/or any
use of any information contained in them, is strictly prohibited and may
be illegal. If you are not an intended recipient then please promptly
delete this e-mail and any attachment and all copies and inform the
sender directly via email. Any emails that you send to us may be
monitored by systems or persons other than the named communicant for the
purposes of ascertaining whether the communication complies with the law
and company policies.
> _______________________________________________
> Wireshark-users mailing list
> [email protected]
> http://www.wireshark.org/mailman/listinfo/wireshark-users

This information is top security. When you have read it, destroy
-- Marshall McLuhan
Wireshark-users mailing list
[email protected]

Experience the true Internet.  Right on your mobile. Right now.

************************************ E-mail Disclaimer ************************************
This e-mail message (together with any attachments) is confidential to the addressee 
and may also be privileged. If you are not the intended recipient, you are hereby notified 
that any dissemination, distribution or copying of this message is strictly prohibited.  
Please also notify the sender immediately by return e-mail and delete it from your system. 
Internet communications cannot be guaranteed to be secure or error-free.  
The sender and the entity through which this message is sent therefore do not accept 
liability for errors or omissions as contained in the message and any spreading of viruses 
as a result of Internet transmission.   
Any opinions contained in this message are those of the sender personally and would 
not bind any entity unless otherwise clearly stated and with the authority of the sender 
duly verified. 

Attachment: sample.rf5
Description: sample.rf5