Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] [RANAP truncated] - 1.10.5

From: "Michal Mazurek (mimazure)" <mimazure@xxxxxxxxx>
Date: Sat, 29 Nov 2014 11:59:38 +0000

Hello,

 

While trying to create a fake RANAP packet I experience a problem that if a RANAP packet is longer than 1 octet (i.e. RANAP SCCP parameter is longer than 1 octet) Wireshark fails to decode the whole RANAP content.

It does not take into account 2 octet length 017A, dissector is provided only with 7A length and only this gets decoded. Long data SCCP parameter shall be working.

 

Is there any coding issue from my side while dumping the packet ?

 

Tested on version 1.10.5 (SVN Rev 54262 from /trunk-1.10).

 

Br,

Michal Mazurek

Engineer, Network Consulting

 

Attachment: RelocationPreparation_RANAP_truncated.pcap
Description: RelocationPreparation_RANAP_truncated.pcap