feature request: add input file options about tzsp2pcap

[sergey-safarov]

Thank you @merlinthemagic
I have tested your suggestion with GRE packets deencapsultion. Works well.
I do not have now TZSP PCAP but think I can filter it the same way.
For my current needs, it will be enough.

If no plans to remove the variable header using tzsp2pcap utility then we can close the ticket.

[merlinthemagic]

@sergey-safarov Once you have a standard PCAP you can apply any number of tools to slice and dice the capture. May i suggest you filter the pcap through tshark to get the subset you are looking for.

[sergey-safarov]

No all utilities understand TZSP protocol.
I use SIP troubleshooting software like sngrep and others. This software do not able to parse manually filtered PCAP die of TZSP encapsulated packets.

So looks as more simple read not only from the network interface and read also from PCAP file.

[merlinthemagic]

Hi @sergey-safarov ,

To clarify you capture packet flows using other tools and these tools cannot decode TZSP so you end up with a pcap containing TZSP frames.

You want to pass those pcap files through "something" that will strip the TZSP headers and output the encapsulated payload into a new pcap?

[sergey-safarov]

You want to pass those pcap files through "something" that will strip the TZSP headers and output the encapsulated payload into a new pcap?

yes, I looking decapsulation tool.

Produced PCAP files will be used with other analysis tools.

[merlinthemagic]

Try this:

tshark -r original.pcap -Y udp.dstport==37008 -w tzspOnly.pcap && editcap -C 47 tzspOnly.pcap tzspDecoded.pcap

tshark and editcap are part of wireshark. The above assumes IPv4 and that your TZSP frames are streaming on UDP:37008, but you can adjust them to fit your specific needs.

Stripping the headers with a static offset works as long as whatever generate the TZSP frames uses a fixed "Tagged Fields" header. However this header is a variable length field, so if you have to ingest varying sets of tagged fields a bit more logic has to be added. But it could be pretty easily accomplished in a loop.

Ethernet header: 14bytes
IP header: 20bytes
UDP header: 8 bytes
TZSP Header 5bytes
Total: 47bytes

[sergey-safarov]

I got a recommendation to use tracewrangler for the packet edit tasks.