This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Query : How to decode MTP3 Message Over TCP using TALI??

0

I want to know how can I decode MTP3 messages encapsulated in TCP using TALI header (rfc 3094) in WireShark??

TALI is enabled in "Enabled Protocol" list on WireShark. But there is no option "Decode as -> TALI" on WireShark. I am using WireShark version 1.8.3 on Windows.

TALI PCAP file uploaded on cloudshark.org

http://cloudshark.org/captures/cf084e5e7a74

asked 16 Apr '13, 08:48

friends's gravatar image

friends
21●4●4●8
accept rate: 0%

edited 16 Apr '13, 23:25

2 Answers:

1

Wireshark's TALI dissector is heuristic, meaning that it attempts to automatically identify TALI packets and decode them--regardless of the TCP ports being used. Once the packets are decoded as TALI then they should automatically be decoded as MTP3.

What does Wireshark say is the highest-level protocol in the frame? TCP or TALI?

Are you sure the traffic is TALI? Looks like the first 4 bytes of each message need to be the ASCII string "TALI". A sample capture (which you could upload to cloudshark.org) might help.

answered 16 Apr '13, 09:06

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k●5●72
accept rate: 27%

Traffic is in TALI. First four bytes is "TALI" and next four bytes are"mtp3".

0000   00 00 00 00 00 00 02 bf 0a 00 00 79 08 00 45 00
0010   00 b1 00 00 00 00 0a 06 00 00 0a 00 00 79 00 00
0020   00 00 01 00 83 05 00 00 00 36 00 00 00 36 50 18
0030   ff ff 00 00 00 00 ***54 41 4c 49 6d 74 70 33*** 00 7f
0040   83 ea 54 ae 15 09 81 03 0e 19 0b 12 08 00 12 04
0050   94 89 41 10 32 54 0b 12 08 00 12 04 94 27 09 00
0060   00 11 5c 62 5a 48 04 ff 5c 49 19 6b 1e 28 1c 06
0070   07 00 11 86 05 01 01 01 a0 11 60 0f 80 02 07 80
0080   a1 09 06 07 04 00 00 01 00 15 02 6c 32 a1 30 02
0090   01 ec 02 01 2e 30 28 84 07 91 94 89 41 10 32 54
00a0   82 07 91 94 88 88 88 88 88 04 14 11 29 0c 91 94
00b0   99 99 99 99 99 00 00 a7 06 c8 32 9b fd 06 01

TALI PCAP file uploaded on cloudshark.org

http://cloudshark.org/captures/cf084e5e7a74

I am receiving MTP3 packet from network and I am converting it into TCP packet using TALI. TALI, TCP, IP, Ethernet are dummy header added to MTP3 PDU.

(16 Apr '13, 20:57) friends

0

There's something wrong with the sending host. It uses 0.0.0.0 as destination, but more importantly it send weird overlapping segments of stream data. These are not passed on to subdissectors.

answered 17 Apr '13, 03:49

Jaap's gravatar image

Jaap ♦
11.7k●16●101
accept rate: 14%

I tried to changing the destination address to a correct address value (192.168.1.2), still wireshark is not decoding TALI PDU.

I am receiving MTP3 packet from network and I am converting it into TCP packet using TALI. TALI, TCP, IP, Ethernet are dummy header added to MTP3 PDU. TCP layer is not decoding the TALI header, that's why it is displaying it as segmented data.

(17 Apr '13, 05:13) friends

Then your TCP dummy headers are wrong. These form overlapping segments which never present a valid TVB to the TALI dissector.

(17 Apr '13, 07:43) Jaap ♦
1

The capture shows as all the packets being segments of a reassembled PDU. That makes me think that there's a length problem somewhere.

Disabling the TALI dissector's "Reassemble TALI messages..." preference shows the packets as TALI but they are malformed at the higher layer. I didn't look further into why that is.

Looks like the length problem (which is preventing the packets from decoding as TALI normally) is that the TALI length is 32512 (which is way too big). Looks like an endianism problem.

(17 Apr '13, 08:00) JeffMorriss ♦

Thanks a lot. This works for me.

(17 Apr '13, 09:02) friends
1

If your tool is Writing a libpcap file adding the dummy headers you are better off Writing MTP3 directly into the file using a DLT of 141 which is MTP3.

(17 Apr '13, 22:23) Anders ♦

I am getting both M3UA and MTP3 PDUs. And I am writing both into one pcap file.

If I use DLT_MTP3 then wireshark will complain for M3UA PDUs.

(18 Apr '13, 00:25) friends

Sorry I don't quite get that is Wireshark complaining that it expects M3UA or ´that it gets M3UA? According to http://www.tcpdump.org/linktypes.html LINKTYPE_MTP3

141

DLT_MTP3

Signaling System 7 Message Transfer Part Level 3, as specified by ITU-T Recommendation Q.704, with no MTP2 header preceding the MTP3 packet.

I would expect that plain MTP3 would work, is that what you have?

(18 Apr '13, 00:45) Anders ♦

I think what @friends means is that s/he's getting both MTP3 and M3UA packets and trying to put them in a single PCAP file. For that purpose, using an Ethernet PCAP file (with MTP3 embedded in TALI/TCP/IP and M3UA in SCTP/IP) is probably the easiest.

Another solution with less ugliness would be to write a PCAP-NG file and put MTP3 natively with LINKTYPE_MTP3 and M3UA with LINKTYPE_Ethernet (or whatever). But that file format's probably harder to hand build.

(18 Apr '13, 07:14) JeffMorriss ♦
showing 5 of 8 show 3 more comments