Re: Decode MTP3 message

[Anya Verizi <anya_verizi () hotmail com>]

For example I will take this sequence :
 MTP3(U)    RCV 1/00: ISUP 0 2 0010c0 001981 0d 3d001000

When I put in txt it like this 0000 05 00 00 00 00 3d 00 10 00 ........ I got Release complete message. 
But I'm not sure what are bits before...I have many those sequences ,ISUP, from which I must figure out where are isup 
messages...


> Date: Fri, 24 Feb 2012 09:24:37 -0500
> From: jeff.morriss.ws () gmail com
> To: wireshark-dev () wireshark org
> Subject: Re: [Wireshark-dev] Decode MTP3 message
>
> Martin Kaiser wrote:
> > Thus wrote Anya Verizi (anya_verizi () hotmail com):
> >
> > > I have to decode this sequence 02 00 10 c0 00 19 81 0f 0f 00 2c 01 01 11 02 16 00 00 but when I put it in txt and 
> > > run as pcap I got this
>
> > your problem is the leading 05 00 00 00 00 bytes
>
>
> Those bytes starting at 05 are, presumably, a fake MTP3 header (i.e., 
> the sequence above is just ISUP but there's no DLT for just ISUP).
>
> Do you know what (ISUP) message type this is supposed to be?  It's 
> clearly not an RLC (0x10).  I don't think it's a Subsequent Address 
> (0x02) and 0x00 and 0xc0 aren't valid either.
>
> Or, do you know what the 02 is supposed to be?  The first octet of...
>
> Are you sure this is ISUP?
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe