Mirror/intercept
1
0
Fork 0
mirror of https://github.com/smittix/intercept.git synced 2026-06-10 06:53:31 -07:00
Code Issues Packages Projects Releases Wiki Activity

Remove tshark -Y display filter that blocked all GSM packets

Browse Source 
The display filter `gsm_a.tmsi || e212.imsi` was too restrictive —
paging requests use different field paths for TMSI so nothing matched.
The capture filter (-f 'udp port 4729') already limits to GSMTAP, and
the parser discards rows without TMSI/IMSI identifiers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Smittix
2026-02-08 19:24:10 +00:00
parent 4d7be047da
commit 3dc16b392b
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/gsm_spy.py
+4 -8
View File
@@ -447,14 +447,10 @@ def _start_monitoring_processes(arfcn: int, device_index: int) -> tuple[subproce
'-f', 'udp port 4729', # Capture filter: only GSMTAP packets
]
# Build display filter from available fields
filter_parts = []
for logical_name in ['ta', 'tmsi', 'imsi']:
if fields.get(logical_name):
filter_parts.append(fields[logical_name])
if filter_parts:
tshark_cmd.extend(['-Y', ' || '.join(filter_parts)])
# No display filter (-Y) — the capture filter (-f 'udp port 4729')
# already limits to GSMTAP packets, and the parser discards rows
# without TMSI/IMSI. A -Y filter on gsm_a.tmsi misses paging
# requests where the TMSI lives under a different field path.
tshark_cmd.extend(['-T', 'fields'])
# Add -e for each available field in known order