The Corelatus Blog
Blog posts from June 2011
Archives
2011 2010 2009
Categories

15th June 2011
Live Wireshark Captures on Windows

I've written about using Wireshark to look at signalling captured from an E1/T1 before. As of a few days ago, it's possible to do live captures on Windows, like this:

 start save_to_pcap 172.16.1.10 1A 2A 16 \\.\pipe\ss7.1
 wireshark -k -i \\.\pipe\ss7.1
When you're capturing live, the SS7 packets appear in Wireshark in real-time.

The new version of 'save_to_pcap' program is part of the C examples, the .zip file contains both source (compiles on Unix and Windows) and .exe files.

It's always been possible to do live captures on Unix, you just pipe stdout:

./save_to_pcap gth21 1A 2A 16 - | wireshark -k -i -

Permalink | c, gth, telecom-signalling, windows.