ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] How tshark identify SMS-DELIVERY or SMS-DELIVERY-REPORT

From: "Anders Broman \(AL/EAB\)" <anders.broman@xxxxxxxxxxxx>
Date: Mon, 18 Dec 2006 12:56:48 +0100
Hi,
In gsm_map
pinfo->p2p_dir = P2P_DIR_RECV; is set of there is an ISDN address string
in there and if
SeriveCentreAddress is present  pinfo->p2p_dir = P2P_DIR_SENT; is set.

The filter is gsm_map

BR
Anders 

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
Sent: den 18 december 2006 11:48
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] How tshark identify SMS-DELIVERY or
SMS-DELIVERY-REPORT

Hi,

Not an expert in this field, but a quick look at the code reveiled this
interesting snippet:

/*
 * this is the GSM 03.40 definition with the bit 2
 * set to 1 for uplink messages
 */
static const value_string msg_type_strings[] = {
    { 0,        "SMS-DELIVER" },
    { 4,        "SMS-DELIVER REPORT" },
......

So it seems that bit 2 is used for direction determination.
This is set in this part of the code:

        /*
         * convert the 2 bit value to one based on direction
         */
        if (pinfo->p2p_dir == P2P_DIR_UNKNOWN)
        {
            /* Return Result ... */
            if (msg_type == 0) /* SMS-DELIVER */
            {
                msg_type |= 0x04; /* see the msg_type_strings */
            }
        }
        else
        {
            msg_type |= ((pinfo->p2p_dir == P2P_DIR_RECV) ? 0x04 :
0x00);
        }

Thanx,
Jaap

On Mon, 18 Dec 2006, joyce wrote:

> Hello All,
>
> Anyone know the tshark filter for gsm_map? The problem I met is: I 
> generated a SMS mt-forwardSM MAP request, however from the pcap file, 
> the "GSM SMS TPDU" part shows the type is "SMS-DELIVER REPORT" instead
of "SMS-DELIVER".
>
> I have checked "3GPP TS 23.040 V6.8.0 (2006-09)" for realization of 
> SMS, in the PDU type SMS-DELIVERY, the
TP-MTI(TP-Message-Type-Indicator) is:
>
> bit1 bit0 Message type
>
> 0 0 SMS-DELIVER (in the direction SC to MS)
>
> 0 0 SMS-DELIVER REPORT (in the direction MS to SC)
>
> Therefore SMS-DELIVERY and SMS-DELIVER REPORT have the same TP-MTI but

> for different direction. Here the question is how tshark will know the

> direction? If it can not know the direction, how does tshark to 
> differentiate the 2 types of TPDU?
>
>
>
> My operation environment:
>
> -          OS: solaris 9/freebsd 6.1,the results are same on the 2
platform
>
> -          Tshark version: 0.99.4
>
>
>
>
>
> Part of the decoded trace:
>
> GSM Mobile Application
>
>     Component: invoke (1)
>
>         invoke
>
>             invokeID: 1
>
>             opCode: localValue (0)
>
>                 localValue: mt-forwardSM (44)
>
>             sm-RP-DA: imsi (0)
>
>                 imsi: 1122334455667788
>
>                 Imsi digits: 1122334455667788
>
>             sm-RP-OA: msisdn (2)
>
>                 msisdn: 3938373731303135
>
>                     0... .... = Extension: Extension
>
>                     .011 .... = Nature of number: Network Specific 
> Number
> (0x03)
>
>                     .... 1001 = Number plan: Private Numbering (0x09)
>
>                     ISDN Address digits: 83737313031353
>
>             sm-RP-UI: 240A9156792562404000000000000000000141
>
>             moreMessagesToSend
>
> GSM SMS TPDU (GSM 03.40) SMS-DELIVER REPORT
>
>     .0.. .... :  TP-User-Data-Header-Indicator: The TP-UD field 
> contains only the short message
>
>     .... .1.. :  TP-More-Messages-to-Send: No more messages are 
> waiting for the MS in this SC
>
>     .... ..00 :  TP-Message-Type-Indicator
>
>     TP-Parameter-Indicator
>
>         0... .... :  No extension
>
>         .000 1... :  Reserved
>
>         .... .0.. :  TP-UDL not present
>
>         .... ..1. :  TP-DCS present
>
>         .... ...0 :  TP-PID not present
>
>     TP-Data-Coding-Scheme (145)
>
>         1001 .... :  Reserved coding groups
>
>
>
>
>
> Thanks.
>
>
>
> Joyce
>
>

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users