This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What can/could this message mean?

asked 01 May '11, 16:29

wired's gravatar image

wired
44131417
accept rate: 9%

Are "Continuation" messages TCP keep-alive messages?

Or is this just information message which (can) tell us that INVITE requests and (re)tries (Status: 100 Trying) (will) continue?

(01 May '11, 16:40) wired

i, "Continuation" in SIP messages means that Wireshark couldn't parse the SIP message properly probably because reassembly did not work properly a couple of bugs/improvements has been made in the TCP dissector in trunk. If you have the possibility to download a build bot build you could try that. Regards Anders

permanent link

answered 02 May '11, 01:16

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

Is reassembling actually encapsulation?

TCP dissector in trunk - What's dissector? Trunk has many meanings, what's the right one in this case?

If S-CSCF sends Continuation message to AS, this means that S-CSCF will continue with reassembling the SIP message?

permanent link

answered 02 May '11, 05:08

wired's gravatar image

wired
44131417
accept rate: 9%

edited 02 May '11, 06:30

When something is transfered over TCP the higher level PDU, in this case SIP may be fragmented e.g there will not be a complete SIP message in a TCP frame. So Wireshark may need to "reassemble" TCP messages to build a complete SIP message to display. In wireshark the programs displaying the protocols are called dissectors. Trunk reefers to the working SW repository where the Wireshark sources are keept. I don't think the S-CSCF has any problems with these messages. Is something not working right?

(02 May '11, 08:20) Anders ♦

Hi.

Probably something wasnt' ok, but I can't be sure. I got the trace from my coworker . Anyway, thanks for explanation.

permanent link

answered 02 May '11, 11:21

wired's gravatar image

wired
44131417
accept rate: 9%

I noticed something:

When I filtered SIP traffic directly from original trace file, message Continuation didn't show up. But when I gave to Wireshark "IP command" to ignore some IP addresses and then filtered SIP traffic again, there it was this Continuation message.

So, if I think clearly and I'm right, Continuation isn't neither SIP request neither SIP answer, but simply application message from Wireshark? ;-)

permanent link

answered 04 May '11, 19:12

wired's gravatar image

wired
44131417
accept rate: 9%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×52
×26
×16
×4
×1

question asked: 01 May '11, 16:29

question was seen: 9,208 times

last updated: 04 May '11, 19:12

p​o​w​e​r​e​d by O​S​Q​A