Wireshark-dev: Re: [Wireshark-dev] FW: ANSI MAP / TCAP dissector hooks
From: "Michael Lum" <[email protected]>
Date: Tue, 22 Aug 2006 13:02:04 -0700
There may be a couple of problems here.

The capture file contains ANSI MAP not GSM MAP.


Michael Lum                  Principal Software Engineer
4600 Jacombs Road            +1.604.276.0055
Richmond, B.C.
Canada V6V 3B1
UTStarcom Canada, Inc.
CDMA Division

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Jeff Morriss
Sent: August 22, 2006 6:28 AM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] FW: ANSI MAP / TCAP dissector hooks

Anders Broman wrote:
> Hi,
> As far as I know the only change was to use range rather than a single 
> ssn value in the preferences of ANSI MAP, probably you got owerlaping 
> ssn definitions in your preferences ( CAMEL ,GSM MAP, RANAP ... ) what 
> does it say at the ssn entry in the SCCP part of the dissection?

Hmm, when I load that capture file the SCCP portion says:

SSN: 6
[Linked to TCAP, TCAP ssn linked to GSM_MAP]

which looks OK.

However, the bottom of the TCAP protocol tree says says "BER Error: 
Wrong field in sequence [...]".

I suppose that's preventing the TCAP dissector from calling the GSM_MAP

[If so should such BER errors fail an assertion or something so the packet
shows up as malformed/dissector bug/whatever??]

> -----Original Message-----
> From: Michael Lum [mailto:[email protected]]
> Sent: August 9, 2006 12:18 PM
> To: '[email protected]'
> Subject: ANSI MAP / TCAP dissector hooks
> Hello,
> why was the way ANSI MAP hooks into TCAP changed?
> I believe there is a problem with it.
> I have attached a capture file with the following:
> M2UA
> MTP3 (ITU)
> My preferences were set to:
> Procedure:
> 1.  Start Ethereal
> 2.  Set filters
> 3.  Load file
> Frames show up as SCCP (ANSI), ERR and DT2
> 4.  Edit preferences, change MTP3 -> ITU
> With Ethereal 0.99.0 everything works fine the four frames come out 
> decoded as ANSI MAP
> with:
> UDT QueryWithPermInvoke(Last) Location Request UDT 
> QueryWithPermInvoke(Last) Routing Request UDT ResponseRetRes(Last) UDT 
> ResponseRetRes(Last)
> Following the same procedure with Wireshark 0.99.2 the decode goes as 
> far as TCAP but not ANSI MAP.
> To get the decode to work properly I have to:
> 5.  Edit preferences, change ANSI MAP SSN Range to something 
> different, apply

Wireshark-dev mailing list
[email protected]