I have a captured structure package
[
{
"_index": "packets-2022-01-25",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"filtered": "frame"
},
"eth": {
"filtered": "eth"
},
"ip": {
"filtered": "ip"
},
"sctp": {
"filtered": "sctp"
},
"s1ap": {
"filtered": "s1ap"
},
"sctp": {
"filtered": "sctp"
},
"s1ap": {
"filtered": "s1ap"
}
}
}
}
]
command -T json -e s1ap.CellIdentity -e s1ap.ENB_UE_S1AP_ID -e s1ap.m_TMSI return
[
{
"_index": "packets-2022-01-25",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"s1ap.CellIdentity": [
"0x06eddd33",
"0x06eddd34"
],
"s1ap.ENB_UE_S1AP_ID": [
"278442",
"278472"
],
"s1ap.m_TMSI": [
"4195248394"
]
}
}
}
]
how can I find out which layer belongs to "s1ap.m_TMSI": ["4195248394"]
perhaps there are ways to fill in fields in the absence of values?
