This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have found lot of ranap messages are not decoded by wireshark. These messages are decoded up to sccp.

--------------------------------------------
No.     Time        Source                Destination           Protocol Length Info
  21781 18.879876   201                   7                     SCCP (Int. ITU) 122    DT1

Frame 21781: 122 bytes on wire (976 bits), 122 bytes captured (976 bits)
Ethernet II, Src: AlcatelL_14:c5:44 (0c:a4:02:14:c5:44), Dst: AlcatelD_cd:c1:0c (00:11:3f:cd:c1:0c)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 1490
Internet Protocol Version 4, Src: 10.50.0.115 (10.50.0.115), Dst: 10.24.16.2 (10.24.16.2)
Stream Control Transmission Protocol, Src Port: m3ua (2905), Dst Port: m3ua (2905)
MTP 3 User Adaptation Layer
Signalling Connection Control Part
    Message Type: Data Form 1 (0x06)
    Destination Local Reference: 0x0d97d8
    .... ...0 = More data: No more data (0x00)
    Pointer to first Mandatory Variable parameter: 1
Data (23 bytes)

0000  d8 76 e8 00 14 c6 cd 00 40 52 00 01 40 02 40 03   .v......@R[email protected]@.
0010  00 00 00 03 40 01 00                              [email protected]
    Data: d876e80014c6cd00405200014002400300000003400100
    [Length: 23]
    -------------------------------------------------
This question is marked "community wiki".

asked 09 Sep '12, 22:11

isarana's gravatar image

isarana
1223
accept rate: 0%

edited 09 Sep '12, 22:47

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245

shall i open a bug report for this ?

(10 Sep '12, 01:37) isarana

Hi, I think the problem might bee that you don't have the connection request in the trace and Wireshark can't figure out the next protocol after SCCP as there is no connection information. You might want to play around with the SCCP preferences it might wotk to set the default payload to ranap.

permanent link

answered 10 Sep '12, 03:51

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

I have set the preferences to ranap. Still its not decoding correctly. alt text

(10 Sep '12, 07:40) isarana
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×8

question asked: 09 Sep '12, 22:11

question was seen: 2,505 times

last updated: 10 Sep '12, 13:05

p​o​w​e​r​e​d by O​S​Q​A