Wireshark-dev: Re: [Wireshark-dev] FW: ANSI MAP / TCAP dissector hooks
From: Jeff Morriss <[email protected]>
Date: Wed, 23 Aug 2006 09:32:44 -0400

Michael Lum wrote:
There may be a couple of problems here.

The capture file contains ANSI MAP not GSM MAP.
Oops, your email did say that, didn't it?  I missed that "small detail" :-(


Michael Lum                  Principal Software Engineer
4600 Jacombs Road            +1.604.276.0055
Richmond, B.C.
Canada V6V 3B1
UTStarcom Canada, Inc.
CDMA Division

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Jeff Morriss
Sent: August 22, 2006 6:28 AM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] FW: ANSI MAP / TCAP dissector hooks

Anders Broman wrote:
As far as I know the only change was to use range rather than a single ssn value in the preferences of ANSI MAP, probably you got owerlaping ssn definitions in your preferences ( CAMEL ,GSM MAP, RANAP ... ) what does it say at the ssn entry in the SCCP part of the dissection?
Hmm, when I load that capture file the SCCP portion says:

SSN: 6
[Linked to TCAP, TCAP ssn linked to GSM_MAP]

which looks OK.

However, the bottom of the TCAP protocol tree says says "BER Error: Wrong field in sequence [...]".
I suppose that's preventing the TCAP dissector from calling the GSM_MAP

[If so should such BER errors fail an assertion or something so the packet
shows up as malformed/dissector bug/whatever??]

-----Original Message-----
From: Michael Lum [mailto:[email protected]]
Sent: August 9, 2006 12:18 PM
To: '[email protected]'
Subject: ANSI MAP / TCAP dissector hooks


why was the way ANSI MAP hooks into TCAP changed?

I believe there is a problem with it.

I have attached a capture file with the following:


My preferences were set to:



1.  Start Ethereal
2.  Set filters
3.  Load file

Frames show up as SCCP (ANSI), ERR and DT2

4.  Edit preferences, change MTP3 -> ITU

With Ethereal 0.99.0 everything works fine the four frames come out decoded as ANSI MAP

UDT QueryWithPermInvoke(Last) Location Request UDT QueryWithPermInvoke(Last) Routing Request UDT ResponseRetRes(Last) UDT ResponseRetRes(Last)
Following the same procedure with Wireshark 0.99.2 the decode goes as 
far as TCAP but not ANSI MAP.
To get the decode to work properly I have to:

5. Edit preferences, change ANSI MAP SSN Range to something different, apply