["Martin Regner" <martin.regner@xxxxxxxxx>]

Paul Jeffress wrote:
> > We use SS7 equipment from two vendors, one of which does not use the 
> > standard SCTP PPID of 3, for their M3UA packets. Instead they use 0.
> > 
> > I had a look at sctpppids.h and see
> > 
> > 
> > #define NOT_SPECIFIED_PROTOCOL_ID  0
> > #define IUA_PAYLOAD_PROTOCOL_ID    1
> > #define M2UA_PAYLOAD_PROTOCOL_ID   2
> > #define M3UA_PAYLOAD_PROTOCOL_ID   3
> > #define SUA_PAYLOAD_PROTOCOL_ID    4
> > 
> > Is there any way to cause Ethereal to interpret a PPID of 0 or 3 as 
> > M3UA, so I can decode both my vendors M3UA correctly?.

Tethereal (the non-GUI version of Ethereal) supports "decode as" for sctp.ppi and sctp.port:

In order to decode sctp.ppi value 0 and 79 as m3ua you could probably use:

<tethereal -r infile.cap -d sctp.ppi==0,m3ua -d sctp.ppi==79,m3ua -V  > outfile.txt

In order to decode sctp.port 7834 as m3ua you could probably use:

<tethereal -r infile.cap -d sctp.port==7834,m3ua -V  > outfile.txt