DT1 ranap message not decoding

Question

I have found lot of ranap messages are not decoded by wireshark. These messages are decoded up to sccp.

--------------------------------------------
No.     Time        Source                Destination           Protocol Length Info
  21781 18.879876   201                   7                     SCCP (Int. ITU) 122    DT1
Frame 21781: 122 bytes on wire (976 bits), 122 bytes captured (976 bits)
Ethernet II, Src: AlcatelL_14:c5:44 (0c:a4:02:14:c5:44), Dst: AlcatelD_cd:c1:0c (00:11:3f:cd:c1:0c)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 1490
Internet Protocol Version 4, Src: 10.50.0.115 (10.50.0.115), Dst: 10.24.16.2 (10.24.16.2)
Stream Control Transmission Protocol, Src Port: m3ua (2905), Dst Port: m3ua (2905)
MTP 3 User Adaptation Layer
Signalling Connection Control Part
Message Type: Data Form 1 (0x06)
Destination Local Reference: 0x0d97d8
…. …0 = More data: No more data (0x00)
Pointer to first Mandatory Variable parameter: 1
Data (23 bytes)
0000  d8 76 e8 00 14 c6 cd 00 40 52 00 01 40 02 40 03   .v……@R[email protected]@.
0010  00 00 00 03 40 01 00                              [email protected]
Data: d876e80014c6cd00405200014002400300000003400100
[Length: 23]
————————————————-

Answer 1

Hi, I think the problem might bee that you don't have the connection request in the trace and Wireshark can't figure out the next protocol after SCCP as there is no connection information. You might want to play around with the SCCP preferences it might wotk to set the default payload to ranap.