This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to know which is the next layer on SCCP - RANAP or BSSAP (not according SSN)

0

Hi. When I have only one frame of SCCP - according what can I know which is the next protocol RANAP or BSSAP. I don't want to rely on the SSN because not always I have the CR message. Thanks, Zeev

asked 07 Nov '12, 00:14

zeev's gravatar image

zeev
1111
accept rate: 0%


One Answer:

0

Well, unless the code has something to "route" on (such as SSN) the code would have to do some kind of heuristic: for example trying to decode as RANAP and if that fails try BSSAP. (This isn't something Wireshark will do currently.)

answered 07 Nov '12, 15:15

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

How do i know that it failed..? I mean, what if I decoded the hole RANAP bytes as BSSAP without finfing any errors..? Thanks

(08 Mar '13, 03:19) Radhwen Khelia

In fact I answered this from the perspective of how Wireshark would know. Anyway, if both decodes succeed, you're right, you (and Wireshark) can't really know.

Keep in mind that "succeed" does not necessarily mean "no errors." You might also have to check the values: some decoded values might be technically legal but make no sense.

(08 Mar '13, 14:31) JeffMorriss ♦