Using the ELSUR Packet Viewer

This topic describes how to upload packet captures so that you can view, copy, and export lawful interception messages in raw hex and decoded formats. It also describes how to decode a single HEX stream.

If you require an overview of the ELSUR packet viewer or a detailed description of the settings refer to the ELSUR Packet Viewer screen and the ELSUR Packet Decoder screen.

This feature requires option E14 Sentinel. If you do not have this option this feature is not available.

  1. On the main menu click Intercept Center, then click ELSUR Packet Viewer.

    The ELSUR Packet Viewer screen opens.

  2. Click Select. Windows Explorer opens. Navigate to the folder and select the required packet capture file n either .pcap and .pcapng formats.

  3. In TCP Port enter the port number.

  4. In ELSUR standard select the electronic surveillance standard for the packet capture.

  5. Click View HEX.

    The ELSUR Packet Viewer Utility screen opens.

  6. Click on each capture to display the decoded message.

    If your network capture contains many different carrier’s ELSUR messages which use more than one TCP port or ELSUR standard then you can use TCP Port and ELSUR Standard then click Apply to cycle through all the combinations that are in your file so that you can view all the decoded messages.

Once your packet capture is uploaded as described in How to upload and view a packet capture you can export the encoded or decoded messages or both.

  1. On the ELSUR Packet Viewer Utility screen click Export.

    The Export dialog box opens.

  2. Select what you want to export then click Export.

    Your packet capture export is now available as .txt file.

Once your packet capture is uploaded as described in How to upload and view a packet capture you can copy both the encoded and decoded messages.

  • To copy the encoded message double-click the message in the Encoded Message (HEX Stream) column of the table. Once it is highlighted you can copy it using your preferred method, for example Ctrl+C, or right click and select Copy.

  • To copy the decoded message highlight the section of the message you want to copy. Once it is highlighted you can copy it using your preferred method, for example Ctrl+C, or right click and select Copy.

  1. On the main menu click Intercept Center, then click ELSUR Packet Viewer.

    The ELSUR Packet Viewer screen opens.

  2. Click click here on the "To start using EPV stream utility to process single HEX streams click here." statement.

    The ELSUR Packet Decoder screen opens.

  3. In HEX Message paste in the message.

  4. In ELSUR standard select the electronic surveillance standard for the HEX stream.

  5. Click Decode.

    The decoded message is displayed.

  6. If required the message can be copied by highlighting the section of the message you want to copy. Once it is highlighted you can copy it using your preferred method, for example Ctrl+C, or right click and select Copy.