This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Decoding GR-533/IN

0

Can anyone help me with decoding a GR-533/IN trace? No matter what I fiddle with wireshark doesn't want to decode the entire TCAP portion of the message.

Thanks

asked 04 Jun '14, 10:30

jsh3650's gravatar image

jsh3650
11112
accept rate: 0%

What is GR-533/IN? Are you saying that the TCAP portion does not translate into INAP or CAMEL or that part of the INAP message isn't decoded correctly? What subsyatemnumber(ssn) is used in the SCCP section? Have you tried changing the INAP/CAMEL prefernces to the ssn used?

(04 Jun '14, 12:23) Anders ♦

It's just IN, the older version of AIN. It's being used to query a LIDB to get the CIC associated with a toll free number. Wireshark decodes up to the opcode but then I get the "BER Error: This field lies beyond the end of the known sequence definition.". The payload/data for SCCP is this:

e2:3b:c7:04:00:01:00:37:e8:33:e9:31:cf:01:01:d0:02:83:01:f2:28:aa:0b:84:09:01:00:11:0a:78:47:75:00:88:84:09:02:00:11:0a:07:48:22:99:99:84:06:07:00:01:03:53:08:df:45:01:17:df:48:01:01

This is a querywithperm message.

Thanks

(04 Jun '14, 13:52) jsh3650

I forgot to answer your other part. Yes, I added in the SSNs, in this case 3 and 254, into the preferences so it would at least decode it to the point it is.

(04 Jun '14, 16:29) jsh3650

One Answer:

0

Unfortunately there is no dissector for AIN and the standard isn't free.

answered 04 Jun '14, 21:21

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

Where "not free" means USD 875, which is very far indeed from "free". You're unlikely to see Wireshark enhanced to dissect IN/AIN unless either 1) there's a spec for it that costs less than USD 875 and somebody has time to implement it or 2) somebody with access to the spec has time to implement it.

(04 Jun '14, 22:59) Guy Harris ♦♦

If it could be "loaned" I wonder if it would be possible to create one, or if there would be legal ramifications for doing so. As much as I hate to admit it these legacy Telcordia standards will be still be around for some time.

(05 Jun '14, 05:55) jsh3650