I analyze SCTP/Q.921 IUA/Q.931 message and wireshark version 1.4.3 decodes them correctly. In a newer version (2.2.4) however, the IUA.DLCI.SAPI = 0 value is decoded as Radio Signaling Procedures and the upper layers get corrupted. In the older wireshark version the same parameter value is decoded as Call Control Procedures and the upper layer are shown correctly. Reference, page 11: https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-Q.921-199709-I!!PDF-E&type=items Please look at it and correct if possible. Thank you Mark Ersek asked 03 Mar '17, 00:23  Mark Ersek |
One Answer:
In newer Wireshark, go to IUA dissector preferences and uncheck "Use GSM SAPI values" option. answered 03 Mar '17, 02:47  Pascal Quantin Thanks, this helps. Mark (03 Mar '17, 02:59) Mark Ersek |
A proper filed bug report, with sample capture, would get you a long way of getting this solved.