Wireshark · Ethereal-dev: Re: [Ethereal-dev] Decoding SCCP from a trace

[Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>]

Hi Thomas,

do you really have SCCP/MTP3/SCTP? This is not standardized. Or
do you mean SCCP/M3UA/SCTP or SCCP/MTP3/M2PA/SCTP. Both version
are supported by ethereal out of the box.

Best regards
Michael

On Jun 24, 2005, at 17:06 Uhr, Thomas Steffen wrote:

> Hi,
>
> I would like to decode SCCP (that is SS7) packages that I traced just
> above the MTP3/SCTP layer. What is the best way to get those packages
> into ethereal, in real time if possible?
>
> I thought I might send the packages via UDP to a port on the
> development machine, and the Ethereal can capture and decode them.
> However, I cannot find a way to decode UDP content with the SCCP
> dissector. What do I have to do to change that? I know that UDP
> usually does not carry SCCP, but it seems the simplest possible
> solution.
>
> An alternative would be to pipe the package through a named pipe (or a
> network socket), but then I would probably need to write a small
> wrapped protocol. And while I heard that Ethereal can read from a
> pipe, I don't know how to configure that either.
>
> So if I could make SCCP appear in the "Decode As" box for a UDP
> stream, I would be a lot closer to my goal. Any ideas?
>
> Thomas
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev