wireshark/plugins/epan/mate/examples/mms.mate

58 lines
1.7 KiB
Plaintext

Transform rm_client_from_http_resp1 {
Match (http_rq);
Match Every (addr) Insert (not_rq);
};
Transform rm_client_from_http_resp2 {
Match (not_rq,ue) Replace ();
};
Pdu mmse_over_http_pdu Proto http Transport tcp/ip {
Payload mmse;
Extract addr From ip.addr;
Extract port From tcp.port;
Extract http_rq From http.request;
Extract content From http.content_type;
Extract resp From http.response.code;
Extract method From http.request.method;
Extract host From http.host;
Extract content From http.content_type;
Extract trx From mmse.transaction_id;
Extract msg_type From mmse.message_type;
Extract notify_status From mmse.status;
Extract send_status From mmse.response_status;
Transform rm_client_from_http_resp1, rm_client_from_http_resp2;
};
Gop mmse_over_http On mmse_over_http_pdu Match (addr, addr, port, port) {
Start (http_rq);
Stop (http_rs);
Extra (host, ue, resp, notify_status, send_status, trx);
};
Transform mms_start {
Match Loose() Insert (mms_start);
};
Pdu mmse_over_wsp_pdu Proto wsp Transport ip {
Payload mmse;
Extract trx From mmse.transaction_id;
Extract msg_type From mmse.message_type;
Extract notify_status From mmse.status;
Extract send_status From mmse.response_status;
Transform mms_start;
};
Gop mmse_over_wsp On mmse_over_wsp_pdu Match (trx) {
Start (mms_start);
Stop (never);
Extra (ue, notify_status, send_status);
};
Gog mms {
Member mmse_over_http (trx);
Member mmse_over_wsp (trx);
Extra (ue, notify_status, send_status, resp, host, trx);
Expiration 60.0;
};