This is our old Q&A Site. Please post any new questions and answers at

I am monitoring Positioning Application Protocol (PCAP) with Wireshark. As CONNECTION-REQUEST SCCP message contains Calling & Called Address that contain SSN Wireshark decodes properly the content of the Data Parameter. For DATA-1 SCCP messages Wireshark does not decode the content of the Data Parameter, it just display the raw data

Data: .....

I suppose that is because DATA-1 messages contain neither Calling nor Called Address and thus no SSN.

How can I force Wireshark to use PCAP decoder for all the SCCP DATA-1 Data Parameters.

Thank you in advance

asked 26 Oct '17, 01:40

oaa's gravatar image

accept rate: 0%

I think you need to enable the Trace Associations preference in the SCCP dissector. That's what makes Wireshark store the called/calling addresses from the CR/CC so it knows how to dissect the DT-1 messages.

permanent link

answered 26 Oct '17, 09:30

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Fine, it worked

Thank you for your help

(27 Oct '17, 00:47) oaa

Your answer has been converted to a comment as that's how this site works. Please read the FAQ for more information.

(27 Oct '17, 01:48) Jaap ♦

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(27 Oct '17, 01:48) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 Oct '17, 01:40

question was seen: 1,932 times

last updated: 27 Oct '17, 01:48

p​o​w​e​r​e​d by O​S​Q​A