ELSUR Packet Viewer screen

This topic provides an overview of the ELSUR Packet Viewer screen and all the settings and buttons on it. However if you require step-by-step procedures on using the ELSUR Packet Viewer refer to Using the ELSUR Packet Viewer.

This feature requires option E14 Sentinel. If you do not have this option this feature is not available.

The ELSUR Packet Viewer screen allows you to upload packet captures so that you can view, copy, and export lawful interception messages in raw hex and decoded formats on the ELSUR Packet Decoder screen. This screen also provides a link to the ELSUR Packet Decoder screen which allows you to input a single hex stream.

When you upload packet captures the data is stored temporarily by OSS-ESPA and is listed on this screen. The uploaded data is used exclusively by the ELSUR Packet Viewer and is not available to any other users or OSS-ESPA features and it is automatically deleted within 48 hours. When you input a single hex streams the data is neither tracked or saved by OSS-ESPA.

If you require information on using the ELSUR Packet Viewer, refer to Using the ELSUR Packet Viewer.

Click to open the ELSUR Packet Decoder screen which allows you to input and decode a single hex stream.

Click to upload your packet capture file in either .pcap and .pcapng formats. Windows Explorer opens. Navigate to the folder containing your files, select the required files then click Open. You can only upload one file at a time.

Enter the Transmission Control Protocol (TCP) port number.

Select the electronic surveillance standard for the packet capture file so that the ELSUR packet viewer can extract all the frames by port. The ELSUR packet viewer extracts all the frames by port.

This setting is only displayed when ELSUR standard is set to "33.108 EPS HI2". To decode this standard you may require to remove the TPKT headers.

Click to view the hex format.

This table lists all the packet capture files you have viewed recently. Files that you have uploaded are automatically deleted within 48 hours.

Click to view and the uploaded file on the ELSUR Packet Viewer screen. This screen also allows you to export the packet.

  • indicates that the import process is queued to start processing or has already started processing and the file cannot yet be used.
  • indicates that the import process has completed successfully and the file can be used.
  • indicates that the import process has completed but with a warning as some packets failed to decode, however the file can be used.
  • indicates that the import process was not completing and the process timed out. The error may be due to the file containing invalid data. Please contact Gladiator Forensics if you require support in resolving this issue.

Click to refresh the files displayed in the table below. You should use the button to refresh the table rather than your browser refresh as occasionally the browser refresh causes an error message.

Click if you want to delete the files you have the check-box selected for in the table below.