I am using Wireshark version 1.6.5 to decode captured RANAP and SCCP packets over M3UA with ANSI configuration point codes. I could observe that only 2 bytes are being considered for point code decoding. Moreover the order of subsystem number and point code seems to be the other way when compared with the ANSI SCCP standard (T1.112.3). This problem is observed only for connectionless SCCP messages like UDT and XUDT. Whole purpose of my testing is XUDT messaging (segmentation and reassembly). In preferences, under MTP3, I have changed the variant to ANSI and SLS to be 5 bits. I am missing some configuration or is this not supported with the current release of Wireshark? asked 03 Mar '12, 20:30  nsvijay |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Hmm, it should work fine in 1.6.5. I just tried it out and it looked okay to me.
What does the Protocol column say? If it's decoding up to SCCP it should say "SCCP (ANSI)" if it is successfully using the ANSI preference. If it doesn't say ANSI then double check the preference setting.
When it decoded SCCP layer, it still shows as SCCP (Intl ITU). In preferences, I just set the MTP3 variant as ANSI. Am I missing any other settings? Can you provide a snapshot of your preferences and output pcap file?
Just setting the MTP3 standard to ANSI works for me. Are you decoding the RFC version of M3UA? Not that I think that should matter. Is this SCTP/M3UA/SCTP/IP/Ethernet?
Yes, I am trying SCCP/M3UA/SCTP/IP/Ethernet. And I have configured RFC3332 version of M3UA.