how to see application layer in wireshark pcap

pcap file which showed a few GSM MAP packets (there were 4 or 5 packets I guess) on the internet, but I can't find it anymore. But it occurs to me we can't be the first ones with this problem - things like HTTP and other application layer parsers/apps must want the ability to 'capture' into a file like pcap at their layer too, so is there some existing solution (encap format, file format, dissector, whatever) that I'm overlooking? I've tried to check the source code of every one that looks like it might do it, but I can't find one.OK so I had seen a. I could write a patch for wireshark to handle a new WTAP_ENCAP_RAW_SIP_SOCKET or some such, with a small header that records the ip:port:transport info we do have at the app layer, and dissector that handles that before calling SIP's dissector. Furthermore, we'd like to change our systems to be able to create a file format and encap type wireshark will (someday) understand natively.

Over TCP in particular, when 'capturing' at the application layer you don't have access to sequence numbers and such, and recording them as UDP packets is really misleading (and screws up). But SIP over TCP exists as well, and even over IPv6. This all worked fine when everything was SIP over UDP over IPv4. We don't want to do real raw packet captures as they're received off-the-wire, because SIP could run over TLS or IPsec and would only show encrypted data. It made sense to do this, because it lets us capture the real IP:port info in the fake IP/UDP headers, so that wireshark displays them and the user can sort/filter based on ip and do conversation analysis, etc. This tool does the classic trick of creating fake Ethernet+IP+UDP headers and formatting the thing as a pcap. For a few years my company's provided a free offline-tool to convert from an internal SIP message capture format of SIP messages received by our system parsers, to pcap format.

How to see application layer in wireshark pcap