Search code examples
wiresharkpacketpcapss7

How to apply abort filter on PCAP?

I am using pcap4j for reading packets in Java. I want to generate an alert on receiving a packet with abort. For now I am unable to apply a filter for abort. I have attached code below.

    PcapHandle handle;
    Pcap pcap;
    handle = 

  Pcaps.openOffline("D://nm_postpaid_testing.pcap",TimestampPrecision.NANO);

    //handle.setFilter("tcap.reason == 11", BpfCompileMode.OPTIMIZE);
    System.out.println("Starting output: ");

    PcapPacket packet = null;


    String filter = "pcap abort 11";
    handle.setFilter(filter, BpfCompileMode.OPTIMIZE);
    PacketListener listener = new PacketListener() {
        @Override
        public void gotPacket(PcapPacket pp) {

            System.out.println("/////////////START////////////////");
            System.out.println(Arrays.toString(pp.getRawData()));

            SctpDecoder sctpDecoder = new SctpDecoder();

            //sctpDecoder.decode(pp.getRawData(), "IP", "*", true, "DECODE:TCAP");

            System.out.println("///////////////END//////////////\n");

        }
    };

    handle.loop(4, listener);

enter image description here

Solution

  • The filtering that can be done by pcap libraries (libpcap/WinPcap/Npcap) is very limited; it can't test for anything as complicated as a TCAP abort. You'd have to dissect the packets in detail, either by writing your own code or by somehow using Wireshark/TShark/sharkd's code, to determine whether the packet you have is a TCP abort.