reconstruct_tcap_dialogue
Reconstruct SS7 TCAP signaling dialogues from a PCAP file, grouping Begin/Continue/End/Abort messages by transaction ID to reveal each dialogue's full lifecycle with MAP operations.
Instructions
Reconstruct SS7 TCAP signaling dialogues from a PCAP file.
Groups TCAP messages (Begin/Continue/End/Abort) by their transaction IDs (OTID/DTID) to show the full lifecycle of each signaling dialogue. MAP operation codes (when present) are included for each component.
Typical protocol stack: SCTP -> M3UA -> SCCP -> TCAP -> MAP
Args: file_path: Path to the PCAP file display_filter: Optional extra filter (e.g. "sccp.called_party == '...'") max_dialogues: Maximum number of dialogues to reconstruct (default: 20)
Returns: Per-dialogue message sequence with timestamps, message types, and MAP ops
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | ||
| max_dialogues | No | ||
| display_filter | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |