From 3dc16b392b7cabeedf4623c38ad4ab5a86820252 Mon Sep 17 00:00:00 2001 From: Smittix Date: Sun, 8 Feb 2026 19:24:10 +0000 Subject: [PATCH] Remove tshark -Y display filter that blocked all GSM packets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The display filter `gsm_a.tmsi || e212.imsi` was too restrictive — paging requests use different field paths for TMSI so nothing matched. The capture filter (-f 'udp port 4729') already limits to GSMTAP, and the parser discards rows without TMSI/IMSI identifiers. Co-Authored-By: Claude Opus 4.6 --- routes/gsm_spy.py | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/routes/gsm_spy.py b/routes/gsm_spy.py index a171e16..e0e9563 100644 --- a/routes/gsm_spy.py +++ b/routes/gsm_spy.py @@ -447,14 +447,10 @@ def _start_monitoring_processes(arfcn: int, device_index: int) -> tuple[subproce '-f', 'udp port 4729', # Capture filter: only GSMTAP packets ] - # Build display filter from available fields - filter_parts = [] - for logical_name in ['ta', 'tmsi', 'imsi']: - if fields.get(logical_name): - filter_parts.append(fields[logical_name]) - if filter_parts: - tshark_cmd.extend(['-Y', ' || '.join(filter_parts)]) - + # No display filter (-Y) — the capture filter (-f 'udp port 4729') + # already limits to GSMTAP packets, and the parser discards rows + # without TMSI/IMSI. A -Y filter on gsm_a.tmsi misses paging + # requests where the TMSI lives under a different field path. tshark_cmd.extend(['-T', 'fields']) # Add -e for each available field in known order