ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] Query regarding processing of "USSD String" message, arriving

From: Ajay Garg <ajaygargnsit@xxxxxxxxx>
Date: Tue, 19 Nov 2013 16:00:36 +0530
Hi all.

We are capturing some GSM-MAP messages over SCTP, and doing some diagnostic testing.

In some packets, we receive a USSD string, encoded in GSM-7-bit format.
I will take a particular example, to illustrate the issue.


The string (GSM 7-bit encoded) is

#################################################
c2301b249dbb6439d7cc060219e5e53248186687dde332483a77c96aaeda0d640fb3d3e4343d0f82dd5e30d94b068bd15ca0e65b5e0691d3613648158bc554b1914b4195d100
#################################################




Wireshark shows the corresponding string as

#################################################
Bal Rs.29.36  Free Balance Rs.25.57 validity 07/02/2014. More dial *111*1#.
T24@
#################################################




Now, we wrote a 7-to-8-bit-ASCII-converter locally at our end, and we get the decoded message as

#################################################
Bal Rs.29.36  Free Balance Rs.25.57 validity 07/02/2014. More dial *111*1#.
T24
#################################################

As is seen, there is no "@" character at the end.



On some more head-banging, we realised that our local decoding seems to be in fact correct, and there seems to be something wrong with the decoded Wireshark message.
The last byte of the message is "00", and there is no way it can be decoded to a "@".

In fact, if we replace the last "00" with "80", we get the "@" at the end (at our local decoding setup, that is).





We will be really grateful, if we could get some light on the "@" appearing at the end in the Wireshark's decoded USSD-string.
We will be happy to share more information about our local decoding-code, but I guess we are missing something obvious :P


Looking forward to a reply :)



Thanks and Regards,
Ajay