I'm trying to filter s1ap communication for a certain M-TMSI. So a1ap.m_TMSI looks like what I'm searching for. M-TMSI format is a hex 4Byte number .... (i.e.: 0x21de4747) How can I search for this or do I misunderstand m_TMSI in wireshark....? Error: "s1ap.m_TMSI==0x021de4747" isn't a valid display filter: "0x021de4747" is not a valid byte string. asked 12 Feb '15, 23:24  dibu |
One Answer:
Try instead: answered 13 Feb '15, 03:00  Pascal Quantin |
sometimes solutions are real simple ....
Thanks
... confusing: filter notation of technical parameter M-TMSI depends on packet you want to get the information from.....
s1ap.m_TMSI==21:de:47:47 --> thats's what I've been looking for ...
nas_eps.emm.m_tmsi == 0x21de4747 --> when I realized that I didn't see all of the packets .....
This is a side effect of the S1AP dissector being automatically generated from the ASN.1 specification where M-TMSI is defined as OCTET STRING (SIZE (4)). This could be easily fixed but would break backward compatibility.