Hi. When I have only one frame of SCCP - according what can I know which is the next protocol RANAP or BSSAP. I don't want to rely on the SSN because not always I have the CR message. Thanks, Zeev asked 07 Nov '12, 00:14  zeev |
One Answer:
Well, unless the code has something to "route" on (such as SSN) the code would have to do some kind of heuristic: for example trying to decode as RANAP and if that fails try BSSAP. (This isn't something Wireshark will do currently.) answered 07 Nov '12, 15:15  JeffMorriss ♦ |
How do i know that it failed..? I mean, what if I decoded the hole RANAP bytes as BSSAP without finfing any errors..? Thanks
In fact I answered this from the perspective of how Wireshark would know. Anyway, if both decodes succeed, you're right, you (and Wireshark) can't really know.
Keep in mind that "succeed" does not necessarily mean "no errors." You might also have to check the values: some decoded values might be technically legal but make no sense.