First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Undissecting tcp2123/tcp2152 currently dissected as GTP

Hi All, can I somehow "undissect" tcp2123/tcp2152 that are currently dissected as GTP? When I click Decode As... , select the last entry in the table (with tcp2123 or tcp2152) and click "-" and save it I still get it dissected as GTP. Apparently entire tcp port space is allowed for use by K8s mgmt comms just 'cos it's Google - no need to check IANA that has them reserved (albeit never actually used) for GTP..... Thanks in advance!

dandreye's avatar
23
dandreye
asked 2021-05-06 17:07:10 +0000, updated 2021-05-06 17:10:59 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

You can disable the GTP dissector. From the menu, Analyze -> Enabled Protocols -> enter gtp in the search field, uncheck the GTP dissector(s).

grahamb's avatar
23.8k
grahamb
answered 2021-05-06 18:12:59 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Well I need it for my genuine GTP traffic that the traffic in question is mixing up with :-)

dandreye's avatar dandreye (2021-05-06 18:18:27 +0000) edit
more
  • delete

Ahh, I misunderstood the question. You have traffic on the GTP port that isn't GTP and you don't want it shown. You'll have to filter out that traffic, hopefully it has a unique factor that allows identification. There's nothing in Wireshark that allows you to not dissect traffic using the dissector registered to the port being used by the traffic.

grahamb's avatar grahamb (2021-05-06 21:40:34 +0000) edit
more
  • delete

@grahamb I see now: thank you (sorry my OP wasn't detailed enough). I'll have to use the IP addresses in it then.

dandreye's avatar dandreye (2021-05-06 21:43:21 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer