This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

meaning of SIP message “Continuation” from S-CSCF to Application Server?

0

What can/could this message mean?

asked 01 May '11, 16:29

wired's gravatar image

wired
44131417
accept rate: 9%

Are "Continuation" messages TCP keep-alive messages?

Or is this just information message which (can) tell us that INVITE requests and (re)tries (Status: 100 Trying) (will) continue?

(01 May '11, 16:40) wired

4 Answers:

0

i, "Continuation" in SIP messages means that Wireshark couldn't parse the SIP message properly probably because reassembly did not work properly a couple of bugs/improvements has been made in the TCP dissector in trunk. If you have the possibility to download a build bot build you could try that. Regards Anders

answered 02 May '11, 01:16

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

0

Is reassembling actually encapsulation?

TCP dissector in trunk - What's dissector? Trunk has many meanings, what's the right one in this case?

If S-CSCF sends Continuation message to AS, this means that S-CSCF will continue with reassembling the SIP message?

answered 02 May '11, 05:08

wired's gravatar image

wired
44131417
accept rate: 9%

edited 02 May '11, 06:30

When something is transfered over TCP the higher level PDU, in this case SIP may be fragmented e.g there will not be a complete SIP message in a TCP frame. So Wireshark may need to "reassemble" TCP messages to build a complete SIP message to display. In wireshark the programs displaying the protocols are called dissectors. Trunk reefers to the working SW repository where the Wireshark sources are keept. I don't think the S-CSCF has any problems with these messages. Is something not working right?

(02 May '11, 08:20) Anders ♦

0

Hi.

Probably something wasnt' ok, but I can't be sure. I got the trace from my coworker . Anyway, thanks for explanation.

answered 02 May '11, 11:21

wired's gravatar image

wired
44131417
accept rate: 9%

0

I noticed something:

When I filtered SIP traffic directly from original trace file, message Continuation didn't show up. But when I gave to Wireshark "IP command" to ignore some IP addresses and then filtered SIP traffic again, there it was this Continuation message.

So, if I think clearly and I'm right, Continuation isn't neither SIP request neither SIP answer, but simply application message from Wireshark? ;-)

answered 04 May '11, 19:12

wired's gravatar image

wired
44131417
accept rate: 9%