Revision history [back]

Hello to all,

Having a pcap with layers like below and even ethernet layer, is possible to remove the first 3 headers, this is Linux cooked capture IPv4 SCTP

and leave only the layers from MTP3 to GSM MAP?

In other word, pass from first image to second image and when I open in Wireshark the pcap only shows MTP3 SCCP GSM Mobie Application GSM SMS

Thanks for any help.

Hello to all,

Having a pcap with layers like below and even ethernet layer, is possible to remove the first 3 headers, this is is

Linux cooked capture
IPv4
SCTP
SCTP

and leave only the layers from MTP3 to GSM MAP?

In other word, pass from first image to second image and when in order when I open the editted pcap in Wireshark the pcap shows only shows these layers?

MTP3
SCCP
GSM Mobie Application
GSM SMS
SMS

Thanks for any help.

Hello to all,

Having a pcap with layers like below and even ethernet layer, is possible to remove the first 3 headers, this is

Linux cooked capture
IPv4
SCTP

and leave only the layers from MTP3 to GSM MAP?

In other word, pass from first image to second image and when image, in order that when I open the editted pcap in Wireshark shows only these layers?

MTP3
SCCP
TCAP
GSM Mobie Application
GSM SMS

Thanks for any help.