Hi,
The capture you posted shows a SIP signaling message between a mobile
and a SIP entity with the mobile SIP client getting a 401 unathorized
message. The message was probably captured on a 3GPP mobile network,
either on the Iu or the Gn interface if you are using 3G-UMTS, or on the
S1-U or S5 if you are playing with LTE. Let's assume was captured the Gn
interface (between SGSN and GGSN). In that case the lower level IPv4
contains the source addresses of the GGSN (172.18.160.57) and SGSN
(10.127.130.19), while the higher level IP, on top of GTP, contains the
addresses of the mobile SIP client (172.18.1.39) and the SIP server
(172.18.196.18). In 3GPP networks the two IP level are called transport
level and user level. Wireshark correctly displays the information on
the user level which is supposed to be more relevant to you as it shows
the traffic exchange between a mobile-client and a server.
BR
/gianluca
On Wed, 2009-08-05 at 22:50 -0700, tulip neo wrote:
> Hi List,
> Good Morning.
> I have bit confusion in IPV4 addressing.In the attached capture u
> would find the data goes through
> ethernet->IPV4->UDP->GTP->IPV4->UDP->SIP.so IPv4 is at top of ethernet
> as well GTP.IPV4 on top of ethernet has source and destination address
> as follows:
>
> 172.18.160.57 and 10.127.130.19
>
> and IPV4 at top of GTP has source and dest address as follows:
>
> 172.18.196.18 and 172.18.1.39.
>
> First source and destination address sensed by wireshark is
> 172.18.160.57 and 10.127.130.19. but why in source and destination
> column the latter is displayed.
> Any pointer or help this would be of great help.Does it conceptulay
> vallid to show the latter or just wireshark works that way.
>
> Br
> tulip
>
>
>
>
> ______________________________________________________________________
> Love Cricket? Check out live scores, photos, video highlights and
> more. Click here.
> ___________________________________________________________________________
> Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
