[Wireshark-dev] Enrich tshark data

2017-09-08 Thread Conall Prendergast
Hi All, Wireshark has the ability to enrich some of the numeric values it sees. For example, if is sees a http status code of 200, it might print "OK" beside it, because HTTP 200 means OK (This is just a guess, Im not sure what it does for HTTP status codes). Is it possible to add this kind of

[Wireshark-dev] TCAP SRT analysis

2017-08-08 Thread Conall Prendergast
Hi All, The TCAP SRT analysis is broken in 2.2.8 and 2.4. I have written a bug on it here . This was broken in this recent change, which does fix another broken issue in v2.2.7.

[Wireshark-dev] TCAP SRT incorrectly matches TC_BEGINs and TC_ENDs

2017-05-25 Thread Conall Prendergast
Hi All, I have been analyzing a TCAP trace with wireshark with the tcap.srt and tcap.persistentsrt options set to "TRUE". This should correctly match TCAP Begins (using 2 pass analysis) with their associated TCAP Ends, and vise-versa. I have attached two files, "correct_matches.pcap" and