The software that I would really like to load into Wireshark is Aethra's
PC_108XP. This software serves as the expert software for many of their
analysers and I think now that the "Export to Ethereal" option (I take your
point about the possible age of formats here), is only for their ADSL &
Ethernet analysers, not my ISDN, & Q.Sig analyser. Capinfos cannot open its
native .aps format, using the Export to Ethereal to a .cap shows up in
capinfos as:-
File name: C:\Users\Keith\Desktop\Environment Agency\QSig
Traces\test.cap
File type: Wireshark/tcpdump/... - libpcap
File encapsulation: OpenBSD PF Firewall logs, pre-3.4
Packet size limit: file hdr: 65535 bytes
Number of packets: 83531
File size: 2506192 bytes
Data size: 1169672 bytes
Capture duration: 58678 seconds
Start time: Fri Sep 30 00:00:03 2011
End time: Fri Sep 30 16:18:01 2011
Data byte rate: 19.93 bytes/sec
Data bit rate: 159.47 bits/sec
Average packet size: 14.00 bytes
Average packet rate: 1.42 packets/sec
SHA1: 7aa7ce58093463bd11982bbcdc1c39e39d748be2
RIPEMD160: f79a3d30c8c0dd243d30862d16b0e09edf8a5d8c
MD5: 6fc2c284d73001665fb1b9516a089b92
Strict time order: True
Hence why I think my best bet (if it is even possible) is to take the Layer
3 hex (and L2 if needed) & some how use text2pcap to try & load it into
Wireshark.
The other analyser that I have borrowed that can output its D channel decode
to Wireshark is called a "Mty Eye" from MOESARC TECHNOLOGY UK LTD. As I
mentioned before it uses a .TRC file, which Wireshark can read and running
capinfos on it shows:-
File name: C:\Users\Keith\Documents\Mty Eye Analyser\Lab
Traces\Mty Eye QSig Trace.trc
File type: EyeSDN USB S0/E1 ISDN trace format
File encapsulation: Per packet
ISDN
EyeSDN Layer 1 event
Digital Private Signalling System No 1 Link Layer
Packet size limit: file hdr: (not set)
Number of packets: 4225
File size: 85527 bytes
Data size: 30414 bytes
Capture duration: 9105 seconds
Start time: Mon Sep 28 10:33:31 2009
End time: Mon Sep 28 13:05:16 2009
Data byte rate: 3.34 bytes/sec
Data bit rate: 26.72 bits/sec
Average packet size: 7.20 bytes
Average packet rate: 0.46 packets/sec
SHA1: dd9e38034ca5394df88e31a1fbcc036ae5dccd7c
RIPEMD160: 59f0380474a80ab6ffcef39c1d860b61bd0f8db7
MD5: 87542e18a170ebc68eb052158e61daca
Strict time order: False
-----Original Message-----
From: Guy Harris
Sent: Friday, October 21, 2011 11:45 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] ISDN Layer 3 decode
On Oct 21, 2011, at 2:27 PM, Keith French wrote:
It does have an Export option to Ethereal, but all packets show up as
malformed.
"Ethereal"? If it really says "Ethereal", it probably dates back before the
introduction of the pcap link-layer types LINKTYPE_LAPD etc.; the only pcap
encapsulation that a release called "Ethereal" supported (the last release
called "Ethereal" was 0.99.0) was LINKTYPE_LINUX_LAPD.
What does capinfos say about the exported-to-Ethereal files?
It can be saved in its own format (which I would think is highly
protected) being a commercial product,
Well, some vendors of commercial network analyzers publish their capture
file format, and others don't, but it might be possible to reverse-analyze
the format. Who are the two vendors in question?
or in CSV or Text. The other analyser I mentioned that uses Wireshark
saves its D channel decodes in TRC format.
What's "TRC format"?
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
