["Banibrata Dutta" <banibrata.dutta@xxxxxxxxxxxxxx>]

Hi Jeff:

these are UDT, and very few XUDT messages (i am using ANSI).
and as it turns out, it was an oversight on my part.
the intial few UDT's i am see'ing are actually couple of
TCAP Acceptance test cases, i.e. open a dialog and send some
little dummy data.

only later few tests contain rather large components, in which
case i think i am getting the XUDT's.

BTW, is there any info on how to plug in new dissectors ?
for that matter even the TCAP and MAP dissectors you sent
over, there must be a place where some registration needs
to be done with the core or the lower layers ??

thanks a ton.
Bani.

-----Original Message-----
From: Jeff Morriss [mailto:morriss@xxxxxxxxxxx]
Sent: Friday, May 02, 2003 8:26 AM
To: Banibrata Dutta
Cc: ethereal-dev
Subject: Re: [Ethereal-dev] SCCP UDAT message contents



Hi Banibrata,

> for all SCCP-user messages, the decode is showing only
> 8 bytes of the payload data, when i know for sure that
> the payload is much bigger. of course i do not expect
> the SCCP disector to disect the contents, but the full
> hex dump of the contents of the undecodable portion is
> desirable.
>
> is the 8 bytes a limitation, or am i doing something wrong?

There is no limitation in the data size (well, except that long data
messages haven't been tested AFAIK).  Are these UDTs or LUDTs?

Here's a 'tethereal' display (sorry, I'm not so good with screen
captures) of a message with 56 bytes of data:

> Signalling Connection Control Part
>     Message Type: Unitdata (0x09)
>     .... 0000 = Class: 0x00
>     0000 .... = Message handling: No special options (0x00)
>     Pointer to first Mandatory Variable parameter: 3
>     Pointer to second Mandatory Variable parameter: 8
>     Pointer to third Mandatory Variable parameter: 13
>     Called Party address (5 bytes)
>         Address Indicator
>             1... .... = National Indicator: Address coded to National
standard (
> 0x01)
>             .1.. .... = Routing Indicator: Route on SSN (0x01)
>             ..00 00.. = Global Title Indicator: No Global Title (0x00)
>             .... ..1. = Point Code Indicator: Point Code present (0x01)
>             .... ...1 = SubSystem Number Indicator: SSN present (0x01)
>         SubSystem Number: Unknown (252)
>         PC (1-16-240)
>             1111 0000 .... .... .... .... = PC Member: 240
>             .... .... 0001 0000 .... .... = PC Cluster: 16
>             .... .... .... .... 0000 0001 = PC Network: 1
>     Calling Party address (5 bytes)
>         Address Indicator
>             1... .... = National Indicator: Address coded to National
standard (
> 0x01)
>             .1.. .... = Routing Indicator: Route on SSN (0x01)
>             ..00 00.. = Global Title Indicator: No Global Title (0x00)
>             .... ..1. = Point Code Indicator: Point Code present (0x01)
>             .... ...1 = SubSystem Number Indicator: SSN present (0x01)
>         SubSystem Number: Unknown (252)
>         PC (1-16-206)
>             1100 1110 .... .... .... .... = PC Member: 206
>             .... .... 0001 0000 .... .... = PC Cluster: 16
>             .... .... .... .... 0000 0001 = PC Network: 1
>     Data (56 bytes)
>
> 0000  e4 36 c7 04 10 6c 40 00 e8 2e e9 2c cf 02 01 0f   .6...l@....,....
> 0010  d1 02 65 01 30 22 8f 07 03 00 77 43 87 28 48 bf   ..e.0"....wC.(H.
> 0020  54 16 06 09 2a 86 48 86 f6 7d 08 41 10 31 09 89   T...*.H..}.A.1..
> 0030  04 00 00 00 00 81 01 01                           ........


In the display does it say "Data (8 bytes)" or some other size?  That
size number comes from the message itself.

If you compile your own Ethereal, you can uncomment the code following
this comment in "packet-sccp.c":

> /*  TODO? I find this annoying, but it could possibly useful for
debugging.
>  *  Make it a preference?

That will turn on display of the lengths of variable parameters.  A
simpler way is to simply click on the "Data" segment and look at the
octet *before* the highlighted section.  That's where "packet-sccp.c"
gets the data length from.

Regards,
-Jeff

ps.  I can take look at the capture if you want to send it to me.

--
Jeff Morriss
Senior Software Support Engineer
Ulticom, Inc.
Helpdesk: +1-856-787-2765
Fax: +1-856-222-9947