[bugzilla-daemon@xxxxxxxxxxxxx]

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1911





------- Comment #5 from jeff.morriss@xxxxxxxxxxx  2007-10-12 16:28 GMT -------
(In reply to comment #4)
> > Are there different versions of the Cisco SM protocol?  Or what is the payload
> > directly above Cisco SM supposed to be (MTP3 or ISUP? ANSI or ITU?)?
> 
> As far as I remember, the first protocol on top of Cisco SM should be MTP3,
> then containing EISUP.
> EISUP is a Cisco proprietary extension to ISUP, adding additional VoIP-specific
> information. I contacted Cisco a few months ago asking if the protocol was
> documented and/or if a dissector was avaialable. They replied that Ethereal was
> already able to decode it.
> I didn't believe them until they showed that to me in person: Ethereal was
> using the ISUP dissector. I can't remember the version they were using, though.

I think you're running into trouble at the SM level, though (since the both the
message type and the message length look wrong).

> This seems to be an old bug/problem, what I'm experiencing is the same as it's
> described here:
> http://www.ethereal.com/lists/ethereal-dev/200405/msg00121.html

Except that his packets contained "sane" SM values:

    Message ID: 0x0000
    Message Type: 0x0010
    Channel ID: 0x0000
    Bearer ID: 0x0000
    Length: 33


Actually, looking at frame 10 in your capture file, I really don't think this
is supposed to be ISUP/MTP3/SM/RUDP--look at all the clear text in the message:

0000  00 03 ba 96 55 f2 00 03 ba 8a b3 06 08 00 45 00   ....U.........E.
0010  01 93 1b 93 40 00 ff 11 cb ac 53 47 76 46 53 47   ....@.....SGvFSG
0020  76 45 1f 43 1f 43 01 7f df 77 40 08 9a a8 25 4f   vE.C.C...w@...%O
0030  00 00 00 00 80 00 01 01 01 67 53 47 76 45 00 03   .........gSGvE..
0040  ba a8 40 01 ac 01 55 76 3d 30 0d 0a 6f 3d 2d 20   ..@...Uv=0..o=- 
0050  38 31 36 35 38 37 20 30 20 49 4e 20 49 50 34 20   816587 0 IN IP4 
0060  38 33 2e 37 31 2e 31 31 38 2e 31 39 38 0d 0a 73   83.71.118.198..s
0070  3d 43 69 73 63 6f 20 53 44 50 20 30 0d 0a 63 3d   =Cisco SDP 0..c=
0080  49 4e 20 49 50 34 20 38 33 2e 37 31 2e 31 31 38   IN IP4 83.71.118
0090  2e 31 39 38 0d 0a 74 3d 30 20 30 0d 0a 6d 3d 61   .198..t=0 0..m=a
00a0  75 64 69 6f 20 31 37 36 37 30 20 52 54 50 2f 41   udio 17670 RTP/A
00b0  56 50 20 38 20 39 39 20 31 38 20 31 30 30 0d 0a   VP 8 99 18 100..
00c0  61 3d 72 74 70 6d 61 70 3a 39 39 20 47 2e 37 32   a=rtpmap:99 G.72
00d0  39 61 2f 38 30 30 30 0d 0a 61 3d 72 74 70 6d 61   9a/8000..a=rtpma
00e0  70 3a 31 30 30 20 58 2d 4e 53 45 2f 38 30 30 30   p:100 X-NSE/8000
00f0  0d 0a 61 3d 66 6d 74 70 3a 31 30 30 20 31 39 32   ..a=fmtp:100 192
0100  2d 31 39 34 2c 32 30 30 2d 32 30 32 0d 0a 61 3d   -194,200-202..a=
0110  58 2d 73 71 6e 3a 30 0d 0a 61 3d 58 2d 63 61 70   X-sqn:0..a=X-cap
0120  3a 20 31 20 61 75 64 69 6f 20 52 54 50 2f 41 56   : 1 audio RTP/AV
0130  50 20 31 30 30 0d 0a 61 3d 58 2d 63 70 61 72 3a   P 100..a=X-cpar:
0140  20 61 3d 72 74 70 6d 61 70 3a 31 30 30 20 58 2d    a=rtpmap:100 X-
0150  4e 53 45 2f 38 30 30 30 0d 0a 61 3d 58 2d 63 70   NSE/8000..a=X-cp
0160  61 72 3a 20 61 3d 66 6d 74 70 3a 31 30 30 20 31   ar: a=fmtp:100 1
0170  39 32 2d 31 39 34 2c 32 30 30 2d 32 30 32 0d 0a   92-194,200-202..
0180  61 3d 58 2d 63 61 70 3a 20 32 20 69 6d 61 67 65   a=X-cap: 2 image
0190  20 75 64 70 74 6c 20 74 33 38 0d 0a 39 02 ac 9b    udptl t38..9...
01a0  00                                                .


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.