|
|
Member
Posts: 15
| I have some messages at my septel.log and I want to decode it.
So far, I can not connect my protocol analyzer into signalling links.
Is there any tool to covert messages from septel.log info Ethereal dump files, or Tektronix K15 record files or to any othere analyzer dump format?
At least, I need to decode SCCP part.
BR. |
|
| |
|
Veteran
Posts: 183
  
Location: Brussels, Belgium | If you enable MTP3 tracing, it should be fairly easy to write a little program that would copy the MSU's from the s7_log generated file (basically, the payload of the MTP_ 0xcf00 message) into a pcap file (format is publicly available on the web), and then Wireshark will take care of the SCCP decoding. One of the gotcha is that MTP3 traces from the Dialogic stack don't contain the MTP2 header (BSN, BIB, FSN, FIB, Length Indicator) so you need to pad them up yourself. |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | You can use text2pcap program for that. Just take the trailing HEX symbols after 'p' in the last part of the log's string, split them by two and put into txt file in format like:
000: 00 01 02 03 04 ....
Then run text2pcap -l 141 input.txt output.pcap
Or you can use my script to do it automatically. Just edit INI file and set appropriate values.
http://www.mib.net.ua/Decoder.rar
Edited by MiB 2007-08-17 04:44
|
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | Hello Bogdan,
I am trying to use your decoder with the attached septel.log file but the resulting pcap file is empty 
I've attached the ini file as well for your scrutinity.
Any clue?
Thanks
Terence
Attachments
----------------
 septel.log (0KB - 50 downloads)
decoder.ini (0KB - 39 downloads)
|
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Hi Terence,
Please set timestamp=0 in INI file, because your septel.log doesn't have timestamp
Edited by MiB 2007-08-17 06:04
|
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | Hi Bogdan,
Well there is a timestamp in my septel.log (altough the time stamp only contains 0's) see the
T 00000000.
I have tried to remove the T 00000000 manually and turn the timestamp to 0 in ini file, but it does not work either.
|
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Please redownload the binary - I've found small bug with timestamp=0
Regarding the T 00000000. I'm using this tool to decode logs from Solaris Septel binary. They looks like:
S7L:2007-08-15 10:52:16.920 I0000 M t0201 i0000 f81 ddf r00 s03 e000000d2
So the format of timestamp is different (no T delimiter).
Please try to use new binary (link is the same) and make a feedback.
Thanks in advance |
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | Your fix works!
Thanks
Terence
PS Regarding your parsing strategy, you may just want to skip everything between the "S7L:" and "M tcf00" or "M t8f01" that way you would no longer the timestamp parameter in the ini file |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Great news 
Anyway I'll continue to use timestamp, because it's really helpful for testing. It allows to see sending/receiving time for each message and then compare it with logs from higher level applications.
P.S. Does anybody have an idea how to decode 'gctload -t2' messages? I have some of them stucked in queue, but I can't determine what are they and why they have stucked. As I understood, the coding scheme is depending on application, but I didn't find anything helpful in Docs... |
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | Can you copy paste the output of gctload -t2? Can you also attach your system.txt file? |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Unfortunately no - those messages may contains "live" GTs, IMSIs and so on... The system is under deployment on the real network and such information is prohibited to go out
Actually, I need a direction to the right way on decoding such messages - all others I'll do by myself |
|
| |
|
Member
Posts: 15
| Nice tool Respect |
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | MiB - 2007-08-16 16:33
Unfortunately no - those messages may contains "live" GTs, IMSIs and so on... The system is under deployment on the real network and such information is prohibited to go out
Actually, I need a direction to the right way on decoding such messages - all others I'll do by myself : )
OK I understand that - but if you want to copy the header part of the message, I can help you finding out the right place in the doc where the format is explained. |
|
| |
|
Member
Posts: 8
| Hi all.
Is it possible to view via Wireshark the SCCP management messages from ss7_log.txt, e.g.
M-t7745-i0000-fef-d33-r8000-p080a10001204000000000000090713d107060012041c0622222222222200
??
I have got a problem with defining GT translation, so I would like to read the configuration messages from config.ms7 file in more readable form.
I used the documentation an the tranlation is clear, but little bit slow.
Thank you for your help.
Mike |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Terence Blaise - 2007-08-21 11:30
OK I understand that - but if you want to copy the header part of the message, I can help you finding out the right place in the doc where the format is explained.
The problem was in SCCP application binary. It was fixed by our developers. So now the queue is empty and I can't get the headers.
Anyway thanks! |
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | Mike - 2007-08-26 12:03
Hi all.
Is it possible to view via Wireshark the SCCP management messages from ss7_log.txt, e.g.
M-t7745-i0000-fef-d33-r8000-p080a10001204000000000000090713d107060012041c0622222222222200
??
I have got a problem with defining GT translation, so I would like to read the configuration messages from config.ms7 file in more readable form.
I used the documentation an the tranlation is clear, but little bit slow.
Thank you for your help.
Mike
Hi Mike
No Wireshark can't decode Dialogic SCCP management messages because these are propriatery.
This said, the parameters of the GTT add request follow the SCCP format, so you can easily decode them as:
P=SCPPN_TARGET_ADDR L=10 10 00 12 04 00 00 00 00 00 00
RoutingInd=0(Route on GT), GTInd=4(GT includes TT, NP, ES and NAI), SSNInd=0, PCInd=0
TT = 0
NP = 1(ISDN/telephony numbering plan (Recommendations E.163 and E.164))
ES = 2(BCD, even number of digits)
Even, NAI = 4(international number)
GTAI = 000000000000
P=SCPPN_PRIMARY_ADDR L=7 13 d1 07 06 00 12 04
RoutingInd=0(Route on GT), GTInd=4(GT includes TT, NP, ES and NAI), SSNInd=1, PCInd=1
PC = 0x0007d1
SSN = 6 (HLR (Home Location Register))
TT = 0
NP = 1(ISDN/telephony numbering plan (Recommendations E.163 and E.164))
ES = 2(BCD, even number of digits)
Even, NAI = 4(international number)
GTAI =
P=SCPPN_GTT_MASK L=6 22 22 22 22 22 22 (222222222222)
Regards
T.Blaise |
|
| |
|
Member
Posts: 8
| Hi Terence,
thank you for your answer. I decoded this kind of messages with SCCP programmers manual and E.xxx recommendations but I thout there should be some kind of delogger. My colleague wrote one, but it works only for MAP messages, type from log is regexp t.7e
I asked because I'm solving specific GT translation problem and without succes. I'm attaching the description. I only changed the original odd MSISDN to 21436587091, binary 123456789001 with filler 0 before the last 1. The numbers we are using are unfortunately sensitive, the even MSISDN 420775942803 (240757498230 binary) is mine
We have a problem with our application that uses DataKinetics SPCI4 card. Application works fine for MSISDNs, whose length is 12, but nothing is sent from the card to the network for other MSISDNs. Looking to the s7_log.txt we found out, that SCCP Maintenance event SCPEV_RTF_TVAL occured. We examined configuration of SCCP module, and found a message that makes the 12-digits MSISDNs work, its
* xxxx -> HLR xxxx
M-t7745-i0000-fef-d33-r8000-p080a10001204000000000000090713d107060012041c0622222222222200
We wanted to create a new configuration message, that would do the same for MSISDNs of length 11 and 13. First we made a translation rule just for one particular MSISDN of length 11, in order to be sure that Add GT Translation Configuration Message really solves our problem. We used this
M-t7745-i0000-fef-d33-r8000-p080a10001104123456789001090d13d1070600120412345678900100
and everything worked for this one MSISDN. So we add GTT mask parametr and add to configuration this two messages
M-t7745-i0000-fef-d33-r8000-p080a10001104000000000000090713d107060011041c0622222222220200
M-t7745-i0000-fef-d33-r8000-p080b1000110400000000000000090713d107060011041c072222222222220200
but nothing was sent from the card again. We traced the traffic in s7_log.txt and found a difference between the translation, that makes SCCP with MSISDNs of length 12 and 11. It looks like this:
* length 12
S7L:I0000 T 02d6a0d3 M tc740 i0000 f14 d33 s00 p01010100020102030102050b1206001204240757498230040b120800120424709799003506456243480400b0a7206b1a2818060700118605010101a00d600ba1090607040000010014026c1fa11d02010002012d301580079124075749823081010082079124709799003500
S7L:I0000 T 02d6a0d3 M tc000 i0000 f33 d22 s00 p83d187c8200901030e190b12060012042407574982300b1208001204247097990035456243480400b0a7206b1a2818060700118605010101a00d600ba1090607040000010014026c1fa11d02010002012d3015800791247077531049810100820791247097990035
* length 11
S7L:I0000 T 00195b76 M tc740 i0000 f14 d33 s00 p01010100020103030102050b1206001104123456789001040b1208001204247097990035064562434804000081306b1a2818060700118605010101a00d600ba1090607040000010014026c1fa11d02010002012d30158007911234567890f181010082079124709799003500
S7L:I0000 T 00195b76 M tc000 i0000 f33 d22 s00 p83d187c830090103131e10120600120400000000000000306164630b12080012042470979900354562434804000081306b1a2818060700118605010101a00d600ba1090607040000010014026c1fa11d02010002012d30158007911346367682f5810100820791247097990035
The translation for MSISDNs of length 11 is obviously wrong, as the MSISDN changes to nulls and even the length of the message is different. We tried some variants of configuration, for example to replace the filler 0 in GTT mask to 2:
M-t7745-i0000-fef-d33-r8000-p080a10001104000000000000090713d107060011041c0622222222222200
M-t7745-i0000-fef-d33-r8000-p080b1000110400000000000000090713d107060011041c072222222222222200
but nothing worked. We would really appreciate any kind help with binary format of the translation rule we need, or something like section 5.7.1 (Example configurations of address pattern matching) of SCCP Programmers Manual, but more detailed and with examples of binary coded messages, that could be directly given to s7_play utility.
Thank you for your help!
Regards,
Mike
|
|
| |
|
Member
Posts: 8
| May I have please one more question? Is there any documentation which can I use for tranlation this kind of messages??
S7L:I0000 T 00248b6a M tc000 i0000 f33 d22 s00 p83d187c8800901030e190b12080012042470079999790b12080012042470979900355e625c4804000080806b1a2818060700118605010101a00d600ba1090607040000010015036c38a13602010002012e302e840791247007999979820791247077531049041a31000c912470775310490011b80dd4f29c1e6b97e7f3f0b90c02
S7L:I0000 T 00248b6e M t8001 i0003 f22 d33 s00 p832243f4b10900030e190b52080012042470979900350b12080012042470079999794564434904000080806b2a2828060700118605010101a01d611b80020780a109060704000001001503a203020100a305a1030201006c0fa20d020100300802012e3003040100
It should be the lowest part on the stack I think... I'm looking for differences in two tracks and what they mean, because I'm trying to send a MO-FORWARD-SHORT-MESSAGE via MAPv3 including IMSI, but without success...
Thank you very much,
Mike
(Czech Republic, Prague)
|
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Mike - 2007-08-30 14:41
May I have please one more question? Is there any documentation which can I use for tranlation this kind of messages??
...
It should be the lowest part on the stack I think...
Hi Mike,
It was SMS with "test1message", wasn't?
It's not a "lowest part', but the whole message. Once you've applied tracing - all messages will come into septel.log.
To decode it into .pcap format you can use my decoder (see http://www.mib.net.ua). After that use Ethereal or Wireshark to see the messages. |
|
| |
|
Member
Posts: 8
| Hi MiB,
yes, it was a "test1message".. I downloaded your decoder few days ago (nice utility!), I convert the messages succesfully, but I think I configured my Wireshark badly. After opening the pcap file I can see the message decoded as MTP3MG protocol with nonsense data. I tried to change the "enabled protocols" options, but without any success. Should I see the "test1message" decoded dirctly in the Wireshark? Could you give me some hint how to configure the Wireshark, e.g. some protocol settings in Wireshark Preferences?
Thank you for your interest!
Mike |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Mike - 2007-08-31 00:41
Hi MiB,
yes, it was a "test1message".. I downloaded your decoder few days ago (nice utility! ), I convert the messages succesfully, but I think I configured my Wireshark badly. After opening the pcap file I can see the message decoded as MTP3MG protocol with nonsense data. I tried to change the "enabled protocols" options, but without any success. Should I see the "test1message" decoded dirctly in the Wireshark? Could you give me some hint how to configure the Wireshark, e.g. some protocol settings in Wireshark Preferences?
Thank you for your interest!
Mike
That's really strange... I didn't change anything in Wireshark at all.
Please verify, that you specified settings in decoder.ini as follows:
parser=(83)
timestamp=0
Also please try to open attached septel.pcap in your Wireshark. This .pcap was created from your log and in my Wireshark it looks fine (SCCP-TCAP-MAP-GSM SMS TPDU). From the last protocol (GSM SMS TPDU) I got the SMS text. If you still see MTP3MG , than try to reinstall Wireshark.
Edited by MiB 2007-08-31 03:45
Attachments
----------------
septel.pcap (0KB - 16 downloads)
|
|
| |
|
Member
Posts: 8
| Hi,
thank you for your hints. I configured your decoder well, but the Wireshark was damaged in some way. I reinstalled it and it works fine. But I realized that this is the same I can see on our analyzer machine connected directly to the Septel card I'm tracing our request to the card and decoding the messages on every protocol stack layer (MAPuser - MAP, MAP-TCAP, TCAP-SCCP, SCCP-SS7layer3). I didn't realized that this kind of message was something I can see "running in the wires" from outside.. I already have a good GSM network analyzer. But it can't show me why SMS sent in application context MAPv2 are sent properly and MAPv3 with extra IMSI parameter are sent without the IMSI. Tracing the protocol stack from septel.log I found out that maybe I have an old version of MAP because the request from MAPuser comes to MAP with IMSI parameter but the TCAP layer message doesn't contain any...
May I ask you if there is some way how to upgrade the MAP? I found some binaries here (http://www.dialogic.com/support/helpweb/signaling/software4.htm) but I'm not sure about the installation, licensing, backward compactibility and so on.. Don't you know anything about this? Am I not digging in bad direction?
Regards,
Mike |
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | Hi Mike
I assume you are running host based protocols.
You can verify the version of the MAP protocol binary you are currently using by starting the protocol module with the -v command line option from a shell:
E.g. (for Windows)
C:\Septel>map_nt.exe -v
SS7 MAP V4.00
Copyright (C) 1993-2006 Intel Corporation. All rights reserved.
...
You can use Dialogic SS7 protocol binaries without any license in trial mode for 10 consecutive hours, by forking the process with the -t command line option (e.g. FORK_PROCESS map_nt.exe -t). If you have a valid license, then you can upgrade the protocol version just by copying the latest version into your c:\Septel folder.
Let me know if that's clear.
Kind regards,
Terence
|
|
| |
|
Member
Posts: 8
| Hi Terence
Everything you wrote sounds clear. We are running Solaris machine. I looked into the system.txt configuration:
*
* Modules running on the board (all redirected via ssd):
*
REDIRECT 0x10 0x20 * CT bus/Clocking control module
REDIRECT 0x71 0x20 * MTP2 module
REDIRECT 0x22 0x20 * MTP3 module
REDIRECT 0x33 0x20 * SCCP module
REDIRECT 0x14 0x20 * TCAP module
REDIRECT 0x15 0x20 * MAP module
* REDIRECT 0x23 0x20 * ISUP module
REDIRECT 0x8e 0x20 * On-board management module
For sure, there are all files in the /opt/DKseptel directory:
config.ms7
dtc
gctlib.lib
gctload
hstmgr
in_api.lib
mtpsl
rsi
rsi_lnk
rsicmd
s7_log.txt
s7_mgt
s7_play
sctp
sctpd
scu
ss7.dc3
ssds
system.txt
tick_sol
tim_sol
upe
--- plus INC directory
So I think the MAP module is running on the board The gctload version is V1.03. I have no experiences with configuring the card so I'm sorry about following (maybe) stupid questions. Can be the configuration changed easily to run the host-based MAP? Because the MAP is now runnig on the board, can I assume that there will be no license for this module? In spite of this all circumstances, can I send the MO-FORWARD-SHORT-MESSAGE under MAPv3 with IMSI parameter with MAP layer on the board? Is it possible to upgrade the MAP on the card or is it better to switch to host-based MAP?
Thank you a lot for your time!
Kind regards,
Mike |
|
| |
|
Member
Posts: 8
| Hi all!
I found the reason of the GT Translation problem. In the document http://resource.intel.com/telecom/support/ss7/cd/HostProtocolSoftware/Solaris/GA205SSS-SCCP.PDF page 4:
"3. Fault cleared
3.1 Global Title Translation
In previous software release, the SCCP module did not translate
correctly a primary or backup address coded “BCD, odd number of
digits” and not containing any digits in the GT address information. This
has now been corrected."
I used not very nice, but functional solution:
M-t7745-i0000-fef-d33-r8000-p080b1206001104010000000000090813d10706001104011c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104020000000000090813d10706001104021c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104030000000000090813d10706001104031c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104040000000000090813d10706001104041c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104050000000000090813d10706001104051c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104060000000000090813d10706001104061c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104070000000000090813d10706001104071c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104080000000000090813d10706001104081c0620222222222200
M-t7745-i0000-fef-d33-r8000-p080b1206001104090000000000090813d10706001104091c0620222222222200
This works. I'm not sure if it will be useful for anyone today, but maybe one day...
For the MAPv3 SMS I contacted the Dialogic support in Czech Republic.
Have a nice day.
Mike
|
|
| |
|
Veteran
Posts: 183
Location: Brussels, Belgium | Mike - 2007-08-30 20:53
...
*
* Modules running on the board (all redirected via ssd ):
*
REDIRECT 0x10 0x20 * CT bus/Clocking control module
REDIRECT 0x71 0x20 * MTP2 module
REDIRECT 0x22 0x20 * MTP3 module
REDIRECT 0x33 0x20 * SCCP module
REDIRECT 0x14 0x20 * TCAP module
REDIRECT 0x15 0x20 * MAP module
* REDIRECT 0x23 0x20 * ISUP module
REDIRECT 0x8e 0x20 * On-board management module
...
So I think the MAP module is running on the board The gctload version is V1.03. I have no experiences with configuring the card so I'm sorry about following (maybe ) stupid questions. Can be the configuration changed easily to run the host-based MAP? Because the MAP is now runnig on the board, can I assume that there will be no license for this module? In spite of this all circumstances, can I send the MO-FORWARD-SHORT-MESSAGE under MAPv3 with IMSI parameter with MAP layer on the board? Is it possible to upgrade the MAP on the card or is it better to switch to host-based MAP?
..
Hi Mike
Yes indeed you are running MAP onto the SPCI card. It is possible to upgrade the MAP on the card - you just need to download the latest firmware for the SPCI card (it is a binary file called SS7.DC3) from our website and copy it into your /opt/DKseptel directory (make sure to rename the file in lower case). To verify the current version of the firmware file, you can add a -d when you FORK_PROCESS ssds -d and FORK_PROCESS s7_mgt -d.
It is quite easy to migrate from board based to host based protocols with the trial mode option - this just requires a couple of changes in the system.txt (1/ Add a LOCAL 0x15 and 2/ remove the REDIRECT 0x15 0x20 and 3/ add a FORK_PROCESS to fork the map_sol binary using the trial mode option -t, you can download the MAP binary for Solaris from our web-site). For live deployment, you need to buy a MAP host based license.
-Terence
|
|
| |
|
New User
Posts: 2
| Hi,
Can I have the decoder,
http://www.mib.net.ua/Decoder.rar URL is broken. |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | romil.sood - 2007-09-04 08:11
Hi,
Can I have the decoder,
http://www.mib.net.ua/Decoder.rar URL is broken.
Hi,
Of course yes - try http://www.mib.net.ua/
the link for decoder.rar is on the main page. |
|
| |
|
Veteran
Posts: 186
Location: Taiwan | Hi MiB,
I can not find the link on the main page.
can you put the file again?
thank you.
Robin |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | MA517 - 2007-10-08 12:14
Hi MiB,
I can not find the link on the main page.
can you put the file again?
thank you.
Robin
http://www1.mib.net.ua/ |
|
| |
|
Veteran
Posts: 186
Location: Taiwan | thanks for your sharing. it is a powerful utility!!
Edited by MA517 2007-10-18 01:54
|
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Just to close the thread.
Final direct link to decoder is:
http://www.mib.net.ua/2007/10/dk-septel-log-decoder.html |
|
| |
|
Member
Posts: 13
| dear MiB, how can i decode this...
M-tc7e2-i0006-f7d-d15-p01010d13962306001204198911198863030b12080012041989994297750b09060704000001000e0200 |
|
| |
|
Veteran
Posts: 119
Location: India | Hi Roydeba,
Hope this is decoded data
M-tc7e2-i0006-f7d-d15-p01010d13962306001204198911198863030b12080012041989994297750b09060704000001000e0200
MAP_MSG_DLG_REQ Op=0x01 = MAPDT_OPEN_REQ
Parm=0x01=MAPPN_dest_address, L=13, Data= 13 96 23 06 00 12 04 19 89 11 19 88 63
Parm=0x03=MAPPN_orig_address, L=11, Data= 12 08 00 12 04 19 89 99 42 97 75
Parm=0x0b=MAPPN_applic_context, L=9, Data= 06 07 04 00 00 01 00 0e 02 Name=AC_InfoRetrievalContext, Ver=2
|
|
| |
|
New User
Posts: 1
| Hi All,
Please make clear the term :--
#define INPN_SEQ(i,base,size) ((i < size) ? (base + i) : INPN_Null)
which is used next as:
#define INPN_DestinationRoutingAddress(i) (INPN_SEQ(i,27,3)) /* 27-29 reserved */
I am unable to understand the #define methods .
I have INTEL Septel API and library Installed on my linux PC. But The sample code is not available in full. Can any of you provide a working Sample Code.
Thanx
|
|
| |
|
New User
Posts: 2
| Hi All,
Can anybody explain me little more about how to use septel log decoder binay given by mib.
Thanks in advance |
|
| |
|
New User
Posts: 2
| Hi,
When i am running decoder.exe on my window console the i am getting followingerror:
"Can't open Input file : No such file or directory at E:\septel\decoder.exe line 35.
This exe file was created with the evaluation version of Perl2Exe. For more information visit http://www.indigostar.com
(The full version does not display this message with a 2 second delay.)..."
Please let me know the reason of this error.
Thanks. |
|
| |
|
Regular
Posts: 71
| Good tool , I have developed something similiar , but your work seems to be a good work
I am preparing a tool to display Frame slips , and other warnings like RX overrun . etc
Regards
Khalid Sweeseh |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | Khalid, it will be nice if you share your tool with dialogic's community. People here will be glad to make a feedback and may be give you some advice about it. |
|
| |
|
Member
Posts: 21
Location: Kyiv, Ukraine | For those, who have some doubts while using my tool:
1. INI file. It should be placed in the same directory where binary runs.
2. Input file with septel logs is defined in INI file as: workdir\inputfile. I'm using c:\temp\septel.log. When you're getting error in line 35 - this means that no such Input file.
3. Parsing criteria. This will define which messages to show in Wireshark. This is leading bytes of SS7 message. For example, "parser=(83|c3)" will gives you all messages with point codes in NAT0 and NAT1
4. timestamp. If you're using septel on Solaris, then set it to 1, otherwise to 0 (not sure about Linux package - never used it). Solaris package of septel puts timestamp of each message in septel.log. This is really nice feature which allows you to see when actually message came to Dialogic stack.
5. If you're using Solaris or Linux, then you can use simple script to automatically download septel.log into your PC:
Write following lines into text file and rename it to GET_SEPTEL.BAT
--------------
c:\programs\putty\pscp -l USERNAME -pw PASSWORD
IP_ADDRESS:/FULL/PATH/TO/SEPTEL/LOG/septel.log c:\temp\septel.log
cd D:\PATH\TO\DECODER\DIRECTORY
d:
decoder.exe
-------------
After that just run decoded Septel.pcap file in Wireshark. Of course you need pscp from Putty, but it can be easily downloaded from the Internet.
Edited by MiB 2008-02-01 02:44
|
|
| |
septel.log message decoding
| Careers | Newsletter Signup