Ethereal-users: Re: [Ethereal-users] does ethereal support native SS7 capture/decode ?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 06 Sep 2005 10:01:44 -0700
Jeff Morriss wrote:

Capturing with Ethereal is a different story. I saw some talk recently about a patch to libpcap (used by tcpdump and Ethereal) to support native capturing on Septel cards (probably if you compile your own version with a special 'configure' option).

That's in the libpcap 0.9[.x] source. You do need to recompile libpcap, with a special configure option, as that feature uses Intel's Septel/NetStructure software - libpcap has to be linked with it. It should work on Linux. It might be possible to make it work on Solaris; somebody with Solaris and Septel/NetStructure cards and software would have to do the work (which would involve transplanting the changes made to pcap-linux.c to pcap-dlpi.c).

It might also be possible to capture it with some DAG cards from Endace and the latest version of DAG software, as well as libpcap 0.9[.x] - if you have an "HDLC" line, the link-layer type choices (which should appear in the Ethereal GUI) offered are Cisco HDLC, PPP, Frame Relay, and SS7 MTP2.