Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] SCCP XUDT (Segmentation)

From: Andreas Fink <afink@xxxxxxxxxxxxx>
Date: Fri, 11 Jan 2008 17:38:33 +0100
On 11.01.2008, at 17:21, Jeff Morriss wrote:
Andreas Fink wrote:
Does anyone here have a proper sample of a trace of a SCCP XUDT message
including segments?

My self made packet decodes correctly in wireshark but the global title
node doesn't like it and rejects it with 0x08 (Message Transport
Failure) and I don't have anything to compare against what could be wrong.

Here's what I sent

There's some segmented XUDT (and XUDTS) in
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2059


"Message Transport Failure" implies a message ordering problem or
timeout.  Looking at your MTP routing label the 2 messages are on
different SLS despite the fact that Class-1 is selected.  That might be
the problem.  (I didn't check a lot for other possible problems.)


Ah... different SLS.. that could very well be it. I would never have thought of that one.

Alain wrote:

Looking to your capture file, if you set in "/Edit/Preference" the SCCP Protocol with the flag "Reassemble XUDT messages", then you can see correct exchange.
 
I have done it on record 14 & 15 : it's a FORWARDSM map message.

The reassembly works fine. The outgoing message looks perferctly fine otherwise but the XUDTS error I got in response was the thing that puzzled me... The ForwardSM part is well prooven as its being used several million times per day using UDTS. Only in the rare case of long sender/receiver numbers and GSM-MAP phase 2+ and long SMS the message gets too long. In my test case it was 1 byte too big :-(.