Wireshark · Wireshark-dev: Re: [Wireshark-dev] Camel phase 3, INAP over SCCP

["Anders Broman" <anders.broman@xxxxxxxxxxxx>]

Hi,

That looks like the begining of a TCAP message, INAP is then found based on SSN or OID I think. You may have to go to

edit->preferences->inap and select the SSN used by your application. ( 0x81/0x7F should be the length indicator if its the begining of a TCAP message).

Regards

Anders

---

From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of BARILLY YANN
Sent: den 12 maj 2009 16:19
To: Developer support list for Wireshark
Subject: [Wireshark-dev] Camel phase 3, INAP over SCCP

Hi,

I am using Wireshark with k12xx files (.rf5), and I have a problem to recognise INAP.

the data buffer beginning with 62 81 is well recognised as INAP but 62 7F isn't. It is INAP, but is it exactly the same version of INAP, is something different between the protos ?

 

thanks for answers

 

Yann