This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

DT1 ranap message not decoding

0

I have found lot of ranap messages are not decoded by wireshark. These messages are decoded up to sccp.

--------------------------------------------
No.     Time        Source                Destination           Protocol Length Info
  21781 18.879876   201                   7                     SCCP (Int. ITU) 122    DT1

Frame 21781: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) Ethernet II, Src: AlcatelL_14:c5:44 (0c:a4:02:14:c5:44), Dst: AlcatelD_cd:c1:0c (00:11:3f:cd:c1:0c) 802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 1490 Internet Protocol Version 4, Src: 10.50.0.115 (10.50.0.115), Dst: 10.24.16.2 (10.24.16.2) Stream Control Transmission Protocol, Src Port: m3ua (2905), Dst Port: m3ua (2905) MTP 3 User Adaptation Layer Signalling Connection Control Part Message Type: Data Form 1 (0x06) Destination Local Reference: 0x0d97d8 …. …0 = More data: No more data (0x00) Pointer to first Mandatory Variable parameter: 1 Data (23 bytes)

0000 d8 76 e8 00 14 c6 cd 00 40 52 00 01 40 02 40 03 .v……@R[email protected]@. 0010 00 00 00 03 40 01 00 [email protected] Data: d876e80014c6cd00405200014002400300000003400100 [Length: 23] ————————————————-

This question is marked “community wiki”.

asked 09 Sep ‘12, 22:11

isarana's gravatar image

isarana
1223
accept rate: 0%

edited 09 Sep ‘12, 22:47

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245

shall i open a bug report for this ?

(10 Sep ‘12, 01:37) isarana


One Answer:

2

Hi, I think the problem might bee that you don't have the connection request in the trace and Wireshark can't figure out the next protocol after SCCP as there is no connection information. You might want to play around with the SCCP preferences it might wotk to set the default payload to ranap.

answered 10 Sep '12, 03:51

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

I have set the preferences to ranap. Still its not decoding correctly. alt text

(10 Sep '12, 07:40) isarana