packet capture tool: tshark

在solaris下使用tshark命令可以方便抓取现网上的gtp-c v0/v1/v2/echo的包，gtp-u v0/v1的包，diameter s6a/s9的包，dns的包。

If needed, you can modify the name of the capture NIC and the file name:

gtpc: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w gtpc.cap -f "mpls and udp port 2123 or (udp port 3386 and ip[29]!=0xff)"

gtpcv0: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w gtpcv0.cap -f "mpls and udp port 3386 and ip[29]!=0xff"

gtpcv1: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w gtpcv1.cap -f "mpls and udp port 2123 and (ip[29]>=16 and ip[29]<=21)"

gtpcv2: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w gtpcv2.cap -f "mpls and udp port 2123 and ((ip[29]>=32 and ip[29]<=37) or (ip[29]>=66 and ip[29]<=69) or (ip[29]>=95 and ip[29]<=100) or (ip[29]>=162 and ip[29]<=165))"

gtpu: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w gtpu.cap -f "mpls and udp port 2152 or (udp port 3386 and ip[29]==0xff)"

gtpuv0: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w gtpuv0.cap -f "mpls and udp port 3386 and ip[29]==0xff"

gtpuv1: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w gtpuv1.cap -f "mpls and udp port 2152"

diameter s6a: tshark -i igb0  -a files:2 -b filesize:1024 -b files:2 -w dia_s6a.cap -f "mpls and ip[9]==132 and (ip[55]>=61 and ip[55]<=67)"
tshark -i igb0  -a files:2 -b filesize:1024 -b files:2 -w dia_s6a.cap -f "mpls and sctp port 3868 and (ip[55]>=61 and ip[55]<=67)"

dns: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w dns.cap -f "mpls and udp port 53"

echo: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w echo.cap -f "mpls and (udp port 2123 or upd port 3386) and (ip[29]>=1 and ip[29]<=2)"

echo v0: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w echov0.cap -f "mpls and upd port 3386 and (ip[29]>=1 and ip[29]<=2)"

echo v1: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w echov1.cap -f "mpls and udp port 2123 and (ip[28]&0x30>0) and (ip[29]>=1 and ip[29]<=2)"

echo v2: tshark -i igb0 -a files:2 -b filesize:1024 -b files:2 -w echov2.cap -f "mpls and udp port 2123 and (ip[28]&0x40>0) and (ip[29]>=1 and ip[29]<=2)"