pyshark icon indicating copy to clipboard operation
pyshark copied to clipboard

ORAN pcap file does not parse correctly

Open sakaia opened this issue 3 years ago • 1 comments

PyShark does not parse correctly for oran (oran_fh_cus). (in the following output, section,_id does not work)

['DATA_LAYER', '__class__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__getattr__', '__getattribute__', '__getstate__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__le__', '__lt__', '__module__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__setstate__', '__sizeof__', '__str__', '__subclasshook__', '__weakref__', '_all_fields', '_convert_showname_field_names_to_field_names', '_field_name_from_showname', '_field_prefix', '_full_name', '_get_all_field_lines', '_get_all_fields_with_alternates', '_get_field_or_layer_repr', '_get_field_repr', '_get_internal_field_by_name', '_is_fake_field', '_is_intermediate', '_layer_name', '_make_wrapped_field', '_sanitize_field_name', '_showname_fields_converted_to_regular', '_wrapped_fields', 'c-plane_section_type_3,_downlink,_frame', 'duplicate_layers', 'ecprirtcid_(du_port_id', 'ecpriseqid,_seqid', 'field_names', 'get', 'get_field', 'get_field_by_showname', 'get_field_value', 'has_field', 'layer_name', 'pretty_print', 'raw_mode', 'section,_id']

output for sectionID related json output is follows. And the pcap file is taken from https://gitlab.com/wireshark/wireshark/-/issues/17874

/usr/local/bin/tshark -l -n -T json -x -r IQ_sample_ORAN.pcap --no-duplicate-keys

Json output.

          "Section, Id: 1 (PRB: 0-50)": {
            "oran_fh_cus.sectionId_raw": [
              "1",
              26,
              2,
              65520,
              5
            ],
            "oran_fh_cus.sectionId": "1",
            "oran_fh_cus.rb_raw": [
              "0",
              27,
              1,
              8,
              4
            ],

sakaia avatar Feb 03 '22 23:02 sakaia

Is this following output makes something wrong for pyshark? https://gitlab.com/wireshark/wireshark/-/blob/master/epan/dissectors/packet-oran.c#L459-L472

sakaia avatar Feb 04 '22 02:02 sakaia