Hello,
Is there a way to have 'tethereal' verbosely dump the contents of a
particular protocol (eg. SIP) without having the higher-level protocol
details? Sort of like how '-V' dumps the contents of the packet, but I
only want to see the SIP details, and nothing from the udp, ip, or eth
levels.
So in effect I only want to see this for each packet:
8 Frame 17 (831 bytes on wire, 831 bytes captured)
Arrival Time: Feb 22, 2006 11:20:01.514559000
Time delta from previous packet: 0.133627000 seconds
Time since reference or first frame: 8.467530000 seconds
Frame Number: 17
Packet Length: 831 bytes
Capture Length: 831 bytes
Protocols in frame: eth:ip:udp:sip
Session Initiation Protocol
Request-Line: REGISTER sip:sip.execulink.com:5060 SIP/2.0
Method: REGISTER
Resent Packet: False
Message Header
Via: SIP/2.0/UDP 10.81.1.252;branch=z9hG4bK92f917f1A5D03E9E
From: "End User" <sip:login@domain>;tag=7350FD1E-BB419A71
SIP Display info: "End User"
SIP from address: sip:login@domain
SIP tag: 7350FD1E-BB419A71
To: <sip:5555555555@domain>
....
Is this possible with any combination of command-line parameters, or do
I need to post-process the output of Tethereal?
Thanks,
Carl Litt
Network Administrator
Execulink Telecom
begin:vcard
fn:Carl Litt
n:Litt;Carl
org:Execulink Internet;Network Operations
adr:195 Dufferin Ave.;;Suite 603;London;ON;N6A 1K7;Canada
email;internet:carl@xxxxxxxxxxxxx
title:Network Administrator
tel;work:519-456-1098
note;quoted-printable:-----BEGIN PGP PUBLIC KEY BLOCK-----=0D=0A=
Version: GnuPG v1.2.4 (MingW32)=0D=0A=
=0D=0A=
mQGiBD3d4D0RBADN1ldHgasUd4f9LEuRJ9kvIwUzJmmZv5phz2b7L6yWkKFwgTWZ=0D=0A=
HXDD3hXYRgTvWW56fIuAIQXCeHQIQ1ox7omXfl6MXgguy9yozgkYtfXiKCV6Dx+6=0D=0A=
NA8W5JPkiyy6AvI7MZdpBDxch2xqzOisXlyYdbhOvzCrgkjjtr2SDkz9nwCg2S8W=0D=0A=
R0ETpNUD5sSiHn7w/6Oopz8D/ipbTNIRRvJk13cn6q7kRAs5Apxd0MX0ZQrpkKI7=0D=0A=
L2rVN6+H6PEGcvrOr+GlLV9luahd6+FNMUaROnZpRGGmdfzKIZRDOWmc8Y9szNYn=0D=0A=
kJInBrSm9BzvtLVodnlvgjMhmZ19ScnluuL2UMzIuf0KpdmNGkOQvVAheeSXs5eY=0D=0A=
NLkfBACudDX84dIhcD3ucvguEjlKHFowI5tbAHcblLd4jZvXCYAJzVLGAEdH8oWq=0D=0A=
xYDAAk+thsQJUht25OItl+hSQNpQ/pJrthuT3OENk2XIdpos3K4EKG0YR5tYKYZb=0D=0A=
iFTMRMINpf5PXa7qukZsIA5lIzUS77mleA34NWXlnIY4dlYVKLQeQ2FybCBMaXR0=0D=0A=
IDxjYXJsQGV4ZWN1bGluay5jb20+iFcEExECABcFAj3d4D0FCwcKAwQDFQMCAxYC=0D=0A=
AQIXgAAKCRBrr0xwuC5r72jdAJ9VqbFUzYy0gUnlBo0BcbizfmLewwCeMgsUNC0u=0D=0A=
caFSIkZlV8hTYIKVuD2IXwQTEQIAFwUCPd3gPQULBwoDBAMVAwIDFgIBAheAABIJ=0D=0A=
EGuvTHC4LmvvB2VHUEcAAQFo3QCgzm/j/P9upramJ4u2ntocZbDLRtcAnRulSr5b=0D=0A=
7oQI2ZoYef0aIN/Ct98FiEYEEBECAAYFAj3tOz0ACgkQVewcGcWxC+0vCACgwfBV=0D=0A=
h7pXdPz+FKNaLMz1NSL9xZIAn1zq726XFNt2AV2EPMXRyqVU+KbNuQENBD3d4FkQ=0D=0A=
BADq9erWD/Y2vWcVennI4hw2gBu2DPnaBtK1B+VBtgLEREveKQK9psd2pGOWK2Fq=0D=0A=
xpLexA3ntWB/mbJGew53eUooYRnapbSq0gKrhjDc+NhkeILTm59CMKK4ew/FH8PA=0D=0A=
AzLVvFqvwwLOqwaXJhcQkl82iTLzw1D/J3kW6LvSsXtpCwADBQQAvzGmk9vC4Gdf=0D=0A=
P7RhkVJbsyuyb4w8fB5GIiTEsIK94YirC98uFMe1EPGo4hpDaqK8OT3lhvpBMRxc=0D=0A=
65msJPoYQqi+OZT4trA0HcRu5Z9Dnh3gRzrn2zyOuE0PZhx1WHQLIDc+104HXnKF=0D=0A=
abud6ffqmxY/0a+6Y50Qa4V3Rn91CKeIRgQYEQIABgUCPd3gWgAKCRBrr0xwuC5r=0D=0A=
71Z4AKCslscwDuksm0+n5DbxgJ4tddWtJQCghCEKIg6Q5tb250jLWT1pC9WHGFY=3D=0D=0A=
=3DCmbg=0D=0A=
-----END PGP PUBLIC KEY BLOCK-----=0D=0A=
url:http://www.execulink.com
version:2.1
end:vcard