This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Unable to decode GSM_MAP protocol layer..showing upto SCCP

0

we are not able to decode MAP protocol data. All protocols have been enabled, however when analyzing the packets, Wireshark disects and displays packet details/attributes till SCCP layer. Its showing as only data after SCCP. Please guide me to see decoded layers of GSM_MAP protocol.

I have already configured SSN value as 0-8 in GSM MAP.packet is showing as SSN not present:--

{.... ..0. = SubSystem Number Indicator: SSN not present (0x00)}

Please look into the frame number 5 of wireshark traces attached in the below link

https://www.cloudshark.org/captures/4b0aad03eef6

asked 22 Apr '16, 00:50

sunilp's gravatar image

sunilp
6112
accept rate: 0%


One Answer:

1

Worst case you can still enforce the next protocol level by going to Edit -> Preferences -> Protocol -> SCCP and in the "Default Payload" text box type tcap

answered 22 Apr '16, 02:04

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%

Yeah, that's why that default payload preference is there: because normally Wireshark uses the SSN to find the upper layer protocol.

You could also use the Users Table preference to achieve this but it looks like you need to enter an SSN of 255 (for no SSN); also it looks like the "Called PC" parameter is actually the L3 DPC. But I wouldn't advise doing this right now; Wireshark has crashed a couple of times while I've been adjusting that table.

(22 Apr '16, 06:45) JeffMorriss ♦

I opened bug 12364 for the crash.

(22 Apr '16, 13:09) JeffMorriss ♦