This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I can’t read camel pcap file correctly on 1.10.5

0

Hi,

I can't read all the param of InitalDP, can you help what are the SSns need to set in the Edit-> preference ?

I tried with CAMEL->TCAP SSN as 129-254 or INAP->TCAP SSN as 6-252, but still some reading issues...

Plz help

Thanks,

asked 27 Jan '14, 23:14

Hanosh's gravatar image

Hanosh
16559
accept rate: 0%

edited 31 Jan '14, 03:19

grahamb's gravatar image

grahamb ♦
19.8k330206

Can you upload the packet capture you're looking at (http://cloudshark.org/ )?

146 is the typical SSN for Camel, but with the trace you can just look at the SSN in the SCCP header. Does the "Protocol" column display it as Camel, and it's just some fields in the IDP you can't read, or does it not even understand it to be an IDP (does it call the Camel dissector at all)

(28 Jan '14, 14:44) Quadratic

Hi,

I have checked in the cloud and I couldn't see the CAMEL in the protocol column. Can you guide me to decode the complete parameters of IDP or all CAMEL messages.

Hanosh

(28 Jan '14, 19:58) Hanosh

Can you post the URL of the cloudshark link so I can look at the trace?

Also, just so I understand, are you trying to understand the meaning of the fields themselves, or are you trying to confirm the SSN in use in the SCCP header to get Wireshark to decode them correctly?

For decoding, in general the 3GPP maintains the specification here: http://www.3gpp.org/DynaReport/29078.htm

What fields you see in the IDP is going to depend on your setup, what's triggering the IDP (eg: ISUP parameters are passed through in Camel typically as-is) the phase you're using, etc. Camel is nothing if not flexible.

(28 Jan '14, 20:01) Quadratic

Pls check the tracer ... http://cloudshark.org/captures/028324459536

and my requirement is that,we need to decode all the parameters of CAMEL

(28 Jan '14, 20:06) Hanosh

Thanks, I'll take a look. Right off the bat, to decode these correctly in Wireshark you need to set Camel SSN to 12 (reserved) in preferences and set MTP3 to ITU standard. That's a non-default SSN which is why it doesn't know to call the Camel dissector.

(28 Jan '14, 20:20) Quadratic

One Answer:

1

To decode these correctly in Wireshark you need to set Camel SSN to 12 (reserved) in preferences and set MTP3 to ITU standard. That's a non-default SSN which is why it doesn't know to call the Camel dissector.

For decoding it, a few things I see here:

  • Six of the eight IDPs are responded to with continues and are redirected to a new called number.
  • Two of the IDPs aren't responded to. TCAP-level response not even present for the transaction after 6 minutes in the trace file.
  • ASN decoding errors present for most of the parameters in the IDP though the Connect is fine. Might have to dig into the spec to derive a few of those. What Camel phase is intended to be in use here? I'd have to double-check but there might be formatting issues. Where SSN 12 is used I'm assuming this is an R&D lab scenario?

So, basically the SCF is redirecting calls in response to SSF IDPs (6/8 times, anyway). I'm assuming service key 50 maps to an O-CSI trigger, the subscriber has no balance and the new number is an IVR system? That would be the typical scenario for the call flow shown there.

Edit: Figured out the ASN decoding errors. It's an INAP IDP. Call the INAP dissector with SSN 12.

answered 28 Jan '14, 20:43

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 28 Jan '14, 20:53

Hi,

Changed CAMEL SSN as 12, MTP3 as ITU but not able to read the IDP (some BER showing)then I changed to INAP SSN as 6-254 then I can able to read. But some parameters of IDP still showing as extensions (I doubt this is due to any wireshark SSN related configuration or no issue with the trace ? )

Thanks, Hanosh Varghese

(28 Jan '14, 20:45) Hanosh

Ah, the packet is formatted in INAP, not Camel.

In my Wireshark 1.10.2, it will decode without any ASN decoding errors once I just have it call the INAP dissector.

(28 Jan '14, 20:52) Quadratic

Hi,

Thanks for quick and prompt replies...

Your assumption is correct... We are doing some R&D. Our goal is that when IDP comes from the SSF, then our SCF node will respond ETC in order to route the call to the IVRS (over TDM links) and IVRS takes some DTMF from the subscriber then IVRS server inform the SCF (through LAN/WAN (for IVRS and SCF )) to disconnect the call from the IVRS and route to the B party number, we planned to use DFC+CONNECT (scf to ssf)message for this purpose.

Currently, what we checking in the IDP that whether any scfId or correlationId is included ? some documents says that in order to achieve ETC we have to fill scfId and CorrelationId, if you have any idea on this kindly share your valuable feed back to us ? How to upload the architecture using in this site for sharing the concept ?

Thanks, Hanosh Varghese

Thanks, Hanosh Varghese

(28 Jan '14, 21:08) Hanosh

Ah, I see. The short answer is that the 3GPP spec should give it to you if you can find it. :)

I'll probably reply a bit later tomorrow. While I have some experience supporting IN flows there are better Camel people that I can ask in the morning.

(28 Jan '14, 21:21) Quadratic

Thanks, I will wait for your valuable response.. How can I share the architecture ?

Thanks Hanosh Varghese

(28 Jan '14, 21:23) Hanosh

Hi,

Any reply from your CAMEL team ?

I have a doubt while showing CAMEL ETC message in the wireshark showing some limited parameters only when Operator MSC tracer showing complete information, is it possible to show those details in the wireshark tracer ??

See the below switch trace, it showing |Nature of Address Ind , Numbering Plan Indicator...etc. whereas in wireshark these fields are hidden..!!!

|4.1.3.1 Assisting Sspiprouting Address                                                    |
|10000000 |Tag                                          |(CONT P [0])                      |
|00001000 |Length                                       |8                                 |
|00010010 |Number Qualifier Ind                         |- unknown / undefined -           |
|0------- |Odd/Even Indicator                           |Even Number of address signals    |
|-0000011 |Nature of Address Ind                        |National (significant) number     |
|0------- |Number Incomplete Ind                        |Number complete                   |
|-001---- |Numbering Plan Indicator                     |ISDN Nr.plan (E.164)              |
|----10-- |Presentation Restr. Ind                      |Address not available             |
|------01 |Screening Indicator                          |User provided, verified passed    |
|***B5*** |Address signal                               |9847970571                        |

Another Trace

|4.1.3.1 Assisting SSPIPRouting Address                                                 |
|10000000 |Tag                                          |(CONT P [0])                   |
|00000110 |Length                                       |6                              |
|10000000 |Number Qualifier Indicator                   |- unknown / undefined -        |
|1------- |Odd/Even Indicator                           |odd Number of address signals  |
|-0000001 |Nature of Addr. Indicator                    |subscriber number              |
|0------- |Number Incomplete Indic.                     |Number complete                |
|-001---- |Numbering Plan Indicator                     |ISDN numbering plan            |
|----00-- |Addr. Present. Restr. Ind                    |presentation allowed           |
|------11 |Screening Indicator                          |network provided               |
|**b20*** |Address Signal                               |39710                          |
|0000---- |Filler                                       |0                              |
|4.1.3.2 Correlation ID                                                                 |
|10000001 |Tag                                          |(CONT P [1])                   |
|00000101 |Length                                       |5                              |
|00------ |Encoding Scheme                              |coded as BCD String            |
|--0----- |Odd/Even Encoding Scheme                     |BCD even Number of digits      |
|---00000 |Type of Digits                               |reserved for account code      |
|***B4*** |Digits                                       |001343f8                       |
|4.1.3.3 Scf id                                                                         |
|10000011 |Tag                                          |(CONT P [3])                   |
|00000011 |Length                                       |3                              |
|***B3*** |SCF Id                                       |'020160'H                      |
|4.1.3.4 Service Interaction Inds Two                                                   |
|10100111 |Tag                                          |(CONT C [7])                   |
|00000011 |Length                                       |3                              |
|4.1.3.4.1 Bothway Through Connection Ind                                               |
|10000010 |Tag                                          |(CONT P [2])                   |
|00000001 |Length                                       |1                              |
|00000000 |Bothway Through Conn. Ind.                   |Bothway path required          |
(30 Jan '14, 01:01) Hanosh

Sorry, I haven't had a chance yet. Been a busier time than expected.

(30 Jan '14, 13:42) Quadratic

Ok, When you are free kindly follow-up with the team concerned and give an update which will be very helpful to us. Also kindly check the above tracer details. In the wireshark tracer some fields are hidden whereas in Switch tracer shows more information of CAMEL-ETC message.

Thanks

Hanosh Varghese

(30 Jan '14, 21:58) Hanosh
1

@Hanosh,

Your "answer" has been converted to a comment as that's how this site works. Please read the FAQ for more information.

(31 Jan '14, 01:42) grahamb ♦

Ok, I accept your rules, Can you consider this queries are most useful for telecom domain people ?

Hanosh

(31 Jan '14, 01:57) Hanosh

@Hanosh, the question is fine, although please remember that folks here are helping out in the own time, free of charge.

However, posting your reply as an "Answer" and then marking it as the accepted answer is not following the rules. Please take some time to read the FAQ.

(31 Jan '14, 02:09) grahamb ♦

Ok Sir, I understood. Can you tell me the above difference between wireShark and Switch Tracer, why In wireshark some fields are hidden ?

(02 Feb '14, 21:13) Hanosh
showing 5 of 12 show 7 more comments