Wireshark · Wireshark-users: Re: [Wireshark-users] Showing TCAP packets : Ethereal vs. Wireshark

[Guy Harris <guy@xxxxxxxxxxxx>]

Marc Grün wrote:

> I'm doing communication between two machines using the SCCP User 
> Adaptation (SUA) protocol. Using both Ethereal and Wireshark to capture 
> the corresponding packets, I realized that Ethereal shows the 
> connectionless datagram ones as "TCAP CLDT" (and they are said to be 
> malformed...)  whereas Wireshark shows the same as "SUA (RFC 3868) CLDT".
>
> Where does this divergence come from ?

Probably from a change in one of the dissectors between the two versions 
of the software; the difference between "Ethereal" and "Wireshark" is 
that "Ethereal" is the name the software had up to version 0.99.0 and 
"Wireshark" is the name it had starting with version 0.99.2 (I don't 
remember what happend to 0.99.1).  See

	http://www.wireshark.org/faq.html#q1.2

for why the name changed.

What are the version numbers of the two releases you're using?  And do 
you have a small capture file that demonstrates this (if you can just 
extract one packet from the capture and read that into the two versions 
and see the behavior, that would be ideal)?

Also, are the packets said to be malformed in the newer version?  If so, 
it might be that the older version wasn't correctly dissecting them.