Ethereal-dev: Re: [Ethereal-dev] decode BER files

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 22 Oct 2001 13:56:52 -0700 (PDT)
> I would like to know if ethereal can analyse or decode the BER encoded
> files.

Ethereal can decode certain protocols that use the ASN.1 Basic Encoding
Rules, e.g. SNMP, LDAP, and Kerberos.  It does not, however, dissect
*all* protocols that use that format.

> Pls tell me if there are any freeware or opensource softwares to
> decode and encode BER files of TAP3 format.

I don't know if any exist, but, as Ethereal *does* include code that can
be used, by dissectors for BER-encoded protocols, to extract BER-encoded
data from packets, somebody who had

	1) a specification for the protocol you want to dissect

and

	2) time to write a dissector for it

(I have neither the first nor the second, at present) could conceivably
write a dissector for the protocol.

> I would also like to know if ethereal can anlysis the MTP and MAP
> packets of the ss7 layers?

There's a dissector for the "Message Transfer Part Level 3", which are
called by the "MTP2 Peer Adaptation Layer" and "MTP3 User Adaptation
Layer" dissectors; those dissectors, in turn, register with the SCTP
dissector, so the MTP3 dissector will be used for phone calls made over
IP-based networks using SCTP.

I assume that's the MTP to which you're referring; I'm not a telephony
expert.

> I tried to convert one of my ss7 raw packet
> file to pcap by text2pcap but i was unsuccessful.

If this is raw SS7, rather than SS7 protocols running, ultimately, atop
TCP/IP, text2pcap won't help you; libpcap format was designed for
computer networking use, and has no provision for files of raw SS7
traffic that's not running over a computer network such as Ethernet,
FDDI, etc..