Ask Your Question

Help decoding an FTAM capture from a synchronous line, using LAPB encapsulation

asked 2024-01-08 20:34:33 +0000

I have several captures (.cap files) performed with our own physical device. In the past (versions of 2007!) Wireshark could decode LAPB/X.25/FTAM on this file. I'm using the same capture file from then, but can not figure out how to force Wireshark to do the decode.

Any ideas? I could send copies of the .cap file and also printouts from Wireshark with the decode.

Thanks in advance for any help.

Hernando Convers Advanced Relay Corp.

edit retag flag offensive close merge delete


Can you place a capture file on a public file share and update the question with a link to it.

Chuckc gravatar imageChuckc ( 2024-01-08 23:05:09 +0000 )edit

Please find a sample capture file for this case at

A printout from a very old Wireshark shows how it decoded some of the frames, here:

This is what I am looking for... being able to decode as it did in the past.

Thanks for any help!

Hconvers gravatar imageHconvers ( 2024-01-10 18:47:29 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2024-01-10 20:58:52 +0000

Chuckc gravatar image

Will you (please) open an issue for this on Wireshark Gitlab Issues?
It looks like it came in with 12173: x75: Add dissector for X.75 SLP/MLP.
Try a Wireshark from the 4.0 branch (I tested with 4.0.12) - the decode looks like your test1.txt.

edit flag offensive delete link more


Will do.

Thanks for the advice. I'll try with v4.0.12 later. hc

Hconvers gravatar imageHconvers ( 2024-01-10 23:01:36 +0000 )edit

Filed as issue #19595.

Guy Harris gravatar imageGuy Harris ( 2024-01-16 01:00:56 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2024-01-08 20:34:33 +0000

Seen: 72 times

Last updated: Jan 10