[Jeff Morriss <morriss@xxxxxxxxx>]

Guy Harris wrote:

> On Thu, Sep 11, 2003 at 01:46:00PM -0400, Jeff Morriss wrote:
>
> > 1) Rewrite a bunch of the TCAP dissector to look at tag IDs as a triplet 
> > (class, constructor, tag number)
> > 	- this probably has negative filtering consequences: users will 
> > probably want to filter on "tcap.msgtype == 0x62" instead of just the 
> > tag number
>
>
> They actually remember that number?  I have the Ethernet types of IPv4
> and ARP, and the IP protocol numbers for ICMP and TCP, memorized, but
> that's about it.

Probably...  There aren't all that many TCAP message types (that are 
frequently seen anyway).  That and many people are used to decoding hex 
dumps of messages (this is why the raw-SS7 stuff will be quite useful 
for some of us--yes, I know I owe some responses on that thread).

> They might really want to filter on the message type name instead;
> if they did that, it probably wouldn't matter whether the tag number or
> the class/{primitive,constructed}/tag value were used.

Cool--I never knew you could do that.  :-)