Ethereal-users: Re: [Ethereal-users] ITU TCAP decoding might be broken

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Wed, 07 Sep 2005 09:01:50 -0400

Hi Dutta,

Hmm, I'm not sure why you would need to set the preferences _before_ loading the file. For example, when I read your first email, I did these steps:

- open the sample capture
- (at this point all my preferences were wrong: MTP3 was set to ANSI and neither TCAP nor CAMEL were set to use SSN==200)
- Edit->Preferences->Protocols
	- set MTP3 standard to ITU
	- change TCAP and CAMEL SSN ranges to include 200
	- click OK or Apply or whatever

Upon doing that, all the frames were re-dissected with the new preference settings and I could see the TCAP and CAMEL portions.

Regards,
-Jeff

Banibrata Dutta wrote:
Oops, sorry, figured that one out. Thanks Jeff, your tip did help. I
just had to make the preference changes before loading the PCAP file.

regards,
bd

On 9/7/05, Banibrata Dutta <banibrata.dutta@xxxxxxxxx> wrote:

Hi Jeff,

Thanks for pointing that out. I had ensured that atleat MTP3 is
decoded as ITU-T, but beyond that Ethereal doesn't seem to give me a
way to make any explicit choices. I am attaching a GIF of the
screenshot of ethereal that contains what I can see. As you'd see all
I can see is upto SCCP level, not even TCAP. So unless I am able to
highlight TCAP I don't think I'd be able to set preference, isn't that
so?

regards,
bdutta

On 9/6/05, Jeff Morriss <jeff.morriss@xxxxxxxxxxx> wrote:


Banibrata Dutta wrote:

hi,

i feel that the ITU-T TCAP decoding is broken in Ethereal v0.10.12.
while Ethereal is successfully able to decode a pcap file containing
IS-41 MAP operations (so obviously ANSI TCAP is working fine).

the pcap files tried are the one which are available on:-
http://wiki.ethereal.com/SampleCaptures

while I do not remember with absolutely certainity, but i think the
camel.pcap file used to work on an Ethereal version which was about
3-4 gens older. i mean the one available here:-
http://wiki.ethereal.com/SampleCaptures?action=AttachFile&do=get&target=camel.pcap

What problem are you seeing with the decoding of that capture file?  I
just looked at it (briefly) and didn't see any problems.

Note, though, that the CAMEL messages in that capture file are on a
non-standard SSN (200) so you need to change the TCAP and CAMEL SSN
preferences to include SSN==200.

(Of course the MTP3 standard has to be set to ITU, too.)