Re: ANSI TCAP/ANSI MAP dissection problem

["Michael Lum" <michael.lum () starsolutions com>]

Hi Anders,
 
we found the problem with frame #2.
 
The conversation with permission is for continuing the dialog
between the two users.
 
The Transaction ID part of the Conversation Portion contains TWO
transaction identifiers.
 
You'll notice the Transaction ID length is 8 and there are two IDs or 4 octets each:
Originating Transaction ID
Responding Transaction ID
 
So in frame #2
 
Otid = 0x0000000e
Rtid = 0x00000027
 
with the Rtid corresponding to the invoke transaction ID.
 
Thanks 
 
 
Michael Lum (michael.lum () starsolutions com <mailto:michael.lum () starsolutions com> ) | STAR SOLUTIONS 
<http://www.starsolutions.com/>  | Principal Software Engineer
4600 Jacombs Road, Richmond BC, Canada V6V 3B1 | +1.604.303.2315
 


________________________________

        From: wireshark-dev-bounces () wireshark org [mailto:wireshark-dev-bounces () wireshark org] On Behalf Of 
Anders Broman
        Sent: November 17, 2009 12:47 PM
        To: 'Developer support list for Wireshark'
        Subject: Re: [Wireshark-dev] ANSI TCAP/ANSI MAP dissection problem
        
        

        Hi,

        Frame 1:

        BER Error: Unknown field in SET class:CONTEXT(2) tag:390

        I don't have a protocol reference where MCID is included in facilitiesDirective2.

         

        Frame 2:

        I think the problem is that the identifier:

        identifier: 0000000E00000027

        is not the same as in the INVOKE (Frame 1)

        identifier: 00000027 and WS can't match the response.

         

        Frame 3:

        I'll check in a fix.

         

        Best regards

        Anders

         

        
________________________________


        Från: wireshark-dev-bounces () wireshark org [mailto:wireshark-dev-bounces () wireshark org] För Michael Lum
        Skickat: den 17 november 2009 18:38
        Till: Developer support list for Wireshark
        Ämne: Re: [Wireshark-dev] ANSI TCAP/ANSI MAP dissection problem

         

        Crap, I forgot the attachment.

         

        Michael Lum (michael.lum () starsolutions com <mailto:michael.lum () starsolutions com> ) | STAR SOLUTIONS 
<http://www.starsolutions.com/>  | Principal Software Engineer

        4600 Jacombs Road, Richmond BC, Canada V6V 3B1 | +1.604.303.2315

         

                 

                
________________________________


                From: wireshark-dev-bounces () wireshark org [mailto:wireshark-dev-bounces () wireshark org] On Behalf 
Of Michael Lum
                Sent: November 17, 2009 9:34 AM
                To: Developer support list for Wireshark
                Subject: [Wireshark-dev] ANSI TCAP/ANSI MAP dissection problem

                Hello,

                 

                I'm having some issues with the attached capture file.

                 

                This capture contains ITU MTP3.

                 

                There are a couple of issues:

                 

                Frame 2:

                 

                ANSI TCAP problem, conversationWithPerm isn't supported ?

                 

                Frame 3:

                 

                I think this is an ANSI MAP dissector problem.  That last line in the packet details window says 
"Unknown invokeData blob".

                 

                 

                Michael Lum (michael.lum () starsolutions com <mailto:michael.lum () starsolutions com> ) | STAR 
SOLUTIONS <http://www.starsolutions.com/>  | Principal Software Engineer

                4600 Jacombs Road, Richmond BC, Canada V6V 3B1 | +1.604.303.2315

                 

                -- 
                This email was Anti Virus checked by Astaro Security Gateway. http://www.astaro.com

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe