Revision history [back]

Revision 2

updated 2021-10-13 06:35:10 +0000

Hello,

I just realize that I can do "s8hr_tree:add (f.imsi, imsi)" and that allows to fully search for s8hr.imsi == "xxxxx" even though the packet has no real f.imsi data in the raw payload:

if (sip_user ~= nil and sip_host ~= nil) then
  local imsi = extract_imsi(sip_user, sip_host)
  s8hr_tree:add (f.imsi, imsi)
  s8hr_tree:append_text(", IMSI: " .. imsi)

Thank you, Andrea

Revision 1

sezb51

answered 2021-10-13 06:34:38 +0000

Hello,

I just realize that I can do "s8hr_tree:add (f.imsi, imsi)" and that allows to fully search for s8hr.imsi == "xxxxx" even though the packet has no real f.imsi data in the raw payload:

if (sip_user ~= nil and sip_host ~= nil) then
  local imsi = extract_imsi(sip_user, build_imsi(sip_user, sip_host)
  s8hr_tree:add (f.imsi, imsi)
  s8hr_tree:append_text(", IMSI: " .. imsi)

Thank you, Andrea