[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 6, 2003, at 8:29 AM, Michael Lum wrote:

> There is a problem with the RANAP dissector in that it
> will only dissect packets that have the correct SSN.
>
> However, RANAP, and A-interface (BSSAP/BSAP) protocols
> use connection oriented SCCP.  Most of the messages do not
> contain an SSN field.
>
> The following messages are used:
>
> UNITDATA
> Connection Request
> Connection Confirm
> Connection Refused
> DATA FORM 1
> RELEASED
> RELEASE COMPLETE
>
> Only the UNITDATA and Connection Request contain an SSN field.

I presume at least one of those other message types contains payload to 
be dissected as, for example, RANAP, even though they contain no SSN.

> What is the best solution for making sure the dissector gets all
> the messages?

Either

	1) make the dissectors in question heuristic

or

	2) add support for some notion of an SCCP connection that includes the 
ability to attach a dissector to the connection.

There are two mechanisms that could be used for that notion of a 
connection:

	1) conversations, for protocols where packets contain identifiers for 
both endpoints;

	2) circuits, for protocols where packets contain a circuit ID value 
rather than endpoint identifiers.