Hi Banibrata,
for all SCCP-user messages, the decode is showing only
8 bytes of the payload data, when i know for sure that
the payload is much bigger. of course i do not expect
the SCCP disector to disect the contents, but the full
hex dump of the contents of the undecodable portion is
desirable.
is the 8 bytes a limitation, or am i doing something wrong?
There is no limitation in the data size (well, except that long data
messages haven't been tested AFAIK). Are these UDTs or LUDTs?
Here's a 'tethereal' display (sorry, I'm not so good with screen
captures) of a message with 56 bytes of data:
Signalling Connection Control Part
Message Type: Unitdata (0x09)
.... 0000 = Class: 0x00
0000 .... = Message handling: No special options (0x00)
Pointer to first Mandatory Variable parameter: 3
Pointer to second Mandatory Variable parameter: 8
Pointer to third Mandatory Variable parameter: 13
Called Party address (5 bytes)
Address Indicator
1... .... = National Indicator: Address coded to National standard (
0x01)
.1.. .... = Routing Indicator: Route on SSN (0x01)
..00 00.. = Global Title Indicator: No Global Title (0x00)
.... ..1. = Point Code Indicator: Point Code present (0x01)
.... ...1 = SubSystem Number Indicator: SSN present (0x01)
SubSystem Number: Unknown (252)
PC (1-16-240)
1111 0000 .... .... .... .... = PC Member: 240
.... .... 0001 0000 .... .... = PC Cluster: 16
.... .... .... .... 0000 0001 = PC Network: 1
Calling Party address (5 bytes)
Address Indicator
1... .... = National Indicator: Address coded to National standard (
0x01)
.1.. .... = Routing Indicator: Route on SSN (0x01)
..00 00.. = Global Title Indicator: No Global Title (0x00)
.... ..1. = Point Code Indicator: Point Code present (0x01)
.... ...1 = SubSystem Number Indicator: SSN present (0x01)
SubSystem Number: Unknown (252)
PC (1-16-206)
1100 1110 .... .... .... .... = PC Member: 206
.... .... 0001 0000 .... .... = PC Cluster: 16
.... .... .... .... 0000 0001 = PC Network: 1
Data (56 bytes)
0000 e4 36 c7 04 10 6c 40 00 e8 2e e9 2c cf 02 01 0f .6...l@....,....
0010 d1 02 65 01 30 22 8f 07 03 00 77 43 87 28 48 bf ..e.0"....wC.(H.
0020 54 16 06 09 2a 86 48 86 f6 7d 08 41 10 31 09 89 T...*.H..}.A.1..
0030 04 00 00 00 00 81 01 01 ........
In the display does it say "Data (8 bytes)" or some other size? That
size number comes from the message itself.
If you compile your own Ethereal, you can uncomment the code following
this comment in "packet-sccp.c":
/* TODO? I find this annoying, but it could possibly useful for debugging.
* Make it a preference?
That will turn on display of the lengths of variable parameters. A
simpler way is to simply click on the "Data" segment and look at the
octet *before* the highlighted section. That's where "packet-sccp.c"
gets the data length from.
Regards,
-Jeff
ps. I can take look at the capture if you want to send it to me.
--
Jeff Morriss
Senior Software Support Engineer
Ulticom, Inc.
Helpdesk: +1-856-787-2765
Fax: +1-856-222-9947