Wireshark · Ethereal-dev: Re: [Ethereal-dev] [patch] Small patch for flow graph feature for SS7 nodes

[Guy Harris <gharris@xxxxxxxxx>]

Dermot Bradley wrote:
> Guy Harris wrote:
>
> > This indicates that perhaps the model of "data link layer" and 
> > "network layer" addresses isn't sufficient.  Perhaps we need to 
> > generalize that model.
>
> I've finally managed to get some SS7 traces loaded into Ethereal (via 
> text2pcap) which start at the MTP3 layer and work up through SCCP, TCAP, 
> and GSM MAP.
>
> Now obviously the source and destination columns are blank in Ethereal's 
> GUI as there's no IP addresses involved

Why is that obvious?  The columns aren't "source and destination IP 
address", they're "source and destination address", and dissectors can, 
and do, set them to non-IP addresses.

The MTP3 dissector sets "net_src" and "net_dst" to the origin and 
destination "point codes", or whatever they're called.

The problem is that it's setting "net_src" and "net_dst", but not "src" 
or "dst", for some reason, and the latter two are what gets displayed; 
if there's some way to transport MTP3 over IP, perhaps the intent was to 
keep the IP address from getting overwritten, but the *right* way to 
control that is to, as per my mail, just have a stack of addresses and 
let the user control which addresses in a stack should be shown.

> in this scenario I'd really somehow like the 
> source and destination columns to show the SCCP Calling Party and Called 
> Party addresses.

Unless those parameters are in every SCCP packet, that'd require some 
additional work, over and above support for the address stack or some 
such mechanism - the dissector would have to associate that with a 
connection of some sort.