Wireshark Wiki 中文翻译整理专题首页原始页面

MATE：配置示例

WARNING: this example has been blindly translated from the "old" MATE syntax and it has been verified that Wireshark accepts it. However, it has not been tested against any capture file due to lack of the latter. See the original example below if in doubt.Transform rm_client_from_http_resp1 { Match (http_rq); Match Every (addr) Insert (not_rq);};Transform rm_client_from_http_resp2 { Match (not_rq,ue) Replace ();};Pdu mmse_over_http_pdu Proto http Transport tcp/ip { Payload mmse; Extract addr From ip.addr; Extract port From tcp.port; Extract http_rq From http.request; Extract content From http.content_type; Extract resp From http.response.code; Extract method From http.request.method; Extract host From http.host; Extract content From http.content_type; Extract trx From mmse.transaction_id; Extract msg_type From mmse.message_type; Extract notify_status From mmse.status; Extract send_status From mmse.response_status; Transform rm_client_from_http_resp1, rm_client_from_http_resp2;};Gop mmse_over_http On mmse_over_http_pdu Match (addr, addr, port, port) { Start (http_rq); Stop (http_rs); Extra (host, ue, resp, notify_status, send_status, trx);};Transform mms_start { Match Loose() Insert (mms_start);};Pdu mmse_over_wsp_pdu Proto wsp Transport ip { Payload mmse; Extract trx From mmse.transaction_id; Extract msg_type From mmse.message_type; Extract notify_status From mmse.status; Extract send_status From mmse.response_status; Transform mms_start;};Gop mmse_over_wsp On mmse_over_wsp_pdu Match (trx) { Start (mms_start); Stop (never); Extra (ue, notify_status, send_status);};Gog mms { Member mmse_over_http (trx); Member mmse_over_wsp (trx); Extra (ue, notify_status, send_status, resp, host, trx); Expiration 60.0;};


以下是同一个示例，使用“旧”MATE grammar 标注以供参考。

WARNING: this example uses the "old" MATE syntax so it won't work in modern versions of Wireshark. See the examples above for the correct syntax.# MMSE over HTTPAction=PduDef; Name=mmse_over_http_pdu; Proto=http; Transport=tcp/ip; Payload=mmse; addr=ip.addr; port=tcp.port; http_rq=http.request; content=http.content_type;Action=PduExtra; For=mmse_over_http_pdu; resp=http.response.code; method=http.request.method; host=http.host; content=http.content_type;Action=PduExtra; For=mmse_over_http_pdu; method=http.request.method; host=http.host;Action=PduExtra; For=mmse_over_http_pdu; trx=mmse.transaction_id; msg_type=mmse.message_type; notify_status=mmse.status; send_status=mmse.response_status;Action=Transform; Name=rm_client_from_http_resp1; Mode=Insert; Match=Strict; http_rq;Action=Transform; Name=rm_client_from_http_resp1; Mode=Insert; Match=Every; addr; .not_rq;Action=Transform; Name=rm_client_from_http_resp2; Mode=Replace; Match=Strict; not_rq; ue;Action=PduTransform; For=mmse_over_http_pdu; Name=rm_client_from_http_resp1;Action=PduTransform; For=mmse_over_http_pdu; Name=rm_client_from_http_resp2;Action=GopDef; Name=mmse_over_http; On=mmse_over_http_pdu; addr; addr; port; port;Action=GopStart; For=mmse_over_http; http_rq;Action=GopStop; For=mmse_over_http; http_rs;Action=GopExtra; For=mmse_over_http; host; ue; resp; notify_status; send_status; trx;# MMSE over WSPAction=PduDef; Name=mmse_over_wsp_pdu; Proto=wsp; Payload=mmse; Transport=ip; trx=mmse.transaction_id; msg_type=mmse.message_type; notify_status=mmse.status; send_status=mmse.response_status;Action=Transform; Name=mms_start; Match=Loose; .mms_start;Action=PduTransform; Name=mms_start; For=mmse_over_wsp_pdu;Action=GopDef; Name=mmse_over_wsp; On=mmse_over_wsp_pdu; trx;Action=GopStart; For=mmse_over_wsp; mms_start;Action=GopStop; For=mmse_over_wsp; never;Action=GopExtra; For=mmse_over_wsp; ue; notify_status; send_status;# the MMS GoGAction=GogDef; Name=mms; GogExpiration=60.0;Action=GogKey; For=mms; On=mmse_over_http; trx;Action=GogKey; For=mms; On=mmse_over_wsp; trx;Action=GogExtra; For=mms; ue; notify_status; send_status; resp; host; trx;


### MATE 存在的理由

这个示例是 MATE 存在的原因。它旨在配合 Ericsson 的 ViG（Video Gateway）使用。

通过使用 mate.vig_call.calling == "1234567890" 过滤，我可以得到由 “1234567890” 发起的呼叫的所有信令。

WARNING: this example uses the "old" MATE syntax so it won't work in modern versions of Wireshark. See the examples above for the correct syntax.# The file MGC-MGw.mate is a series of transformations necessary to map isup cics to megaco terminationsAction=Include; Filename=MGC-MGw.mate;# this are set before we load the Library so that these are the defaults when Lib items are loadedAction=Settings; ShowPduTree=FALSE; DiscardPduData=TRUE;# see Mate/Library to see what these areAction=Include; Lib=isup;Action=Include; Lib=h225_ras;Action=Include; Lib=q931;Action=Include; Lib=megaco;Action=Include; Lib=rtsp;Action=Include; Lib=sip;# extra attributes needed to trac a callAction=PduExtra; For=q931_pdu; guid=h225.guid; calling=q931.calling_party_number.digits; q931_cause=q931.cause_value;Action=PduExtra; For=isup_pdu; calling=isup.calling; isup_cause=isup.cause_indicator;Action=PduExtra; For=ras_pdu; guid=h225.guid;Action=PduExtra; For=rtsp_pdu; calling=X_Vig_Msisdn;Action=PduExtra; For=sip_pdu; calling=sdp.owner.username;# extra attributes moved from Pdu to GopAction=GopExtra; For=q931_leg; calling; q931_cause; guid;Action=GopExtra; For=isup_leg; calling; isup_cause;# mgw_mgc and mgw_mgc transformation mapping are defined in MGC-MGw.mateAction=GopTransform; For=isup_leg; Name=mgw_mgc;Action=GopTransform; For=mgc_tr; Name=mgc_mgw;Action=GopExtra; For=ras_leg; guid;Action=GopExtra; For=rtsp_ses; calling;Action=GopExtra; For=sip_leg; calling;Action=GogDef; Name=vig_call; GogExpiration=0.5;Action=GogExtra; For=vig_call; isup_cause; q931_cause; term; calling; guid; megaco_ctx; mtp3pc; mtp3pc; cic;# A call has sessions of the following protocolsAction=GogKey; For=vig_call; On=isup_leg; calling;Action=GogKey; For=vig_call; On=isup_leg; term;Action=GogKey; For=vig_call; On=q931_leg; calling;Action=GogKey; For=vig_call; On=q931_leg; guid;Action=GogKey; For=vig_call; On=ras_leg; guid;Action=GogKey; For=vig_call; On=mgc_tr; megaco_ctx;Action=GogKey; For=vig_call; On=mgc_tr; term;Action=GogKey; For=vig_call; On=mgc_tr; mtp3pc; mtp3pc; cic;Action=GogKey; For=vig_call; On=rtsp_ses; calling;Action=GogKey; For=vig_call; On=sip_leg; calling;


MGC-MGw.mate 文件使用 mgw.pl 生成，内容类似：

WARNING: this example uses the "old" MATE syntax so it won't work in modern versions of Wireshark. See the examples above for the correct syntax.Action=Transform; Name=mgw_mgc; Match=Strict; Mode=Insert; mtp3pc=12163; mtp3pc=5378; cic=128; .term=DS1/0/3/0;Action=Transform; Name=mgc_mgw; Match=Strict; Mode=Insert; term=DS1/0/3/0; .mtp3pc=12163; .mtp3pc=5378; .cic=128;


Imported from https://wiki.wireshark.org/Mate/Examples on 2020-08-11 23:16:31 UTC


## 相关 Wireshark Wiki 页面

<ul class="wiki-source-list">
<li><a href="/wiki/wireshark/archive/home-9003110d">Wireshark Wiki 首页</a><span>Home · 入门与使用</span></li>
<li><a href="/wiki/wireshark/archive/mate-accident">Mate/Accident</a><span>Mate/Accident · 全量归档</span></li>
<li><a href="/wiki/wireshark/archive/mate-discussion">Mate/Discussion</a><span>Mate/Discussion · 全量归档</span></li>
</ul>

MATE：配置示例 ​

MATE：配置示例