Wireshark · Ethereal-users: Re: [Ethereal-users] SCTP PPID for M3UA.

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Paul Jeffress wrote:
> Hi,
>
> We use SS7 equipment from two vendors, one of which does not use the 
> standard SCTP PPID of 3, for their M3UA packets. Instead they use 0.
>
> I had a look at sctpppids.h and see
>
>
> #define NOT_SPECIFIED_PROTOCOL_ID  0
> #define IUA_PAYLOAD_PROTOCOL_ID    1
> #define M2UA_PAYLOAD_PROTOCOL_ID   2
> #define M3UA_PAYLOAD_PROTOCOL_ID   3
> #define SUA_PAYLOAD_PROTOCOL_ID    4
>
> Is there any way to cause Ethereal to interpret a PPID of 0 or 3 as 
> M3UA, so I can decode both my vendors M3UA correctly?.
>
> I also had a look to try and change the code myself, but it's been 
> toooooo long since I've coded and could not figure it out.

Not without recompiling Ethereal.  If you don't mind doing that, you 
could change "epan/dissectors/packet-m3ua.c" to register for 
NOT_SPECIFIED_PROTOCOL_ID here:

>   dissector_add("sctp.ppi",  M3UA_PAYLOAD_PROTOCOL_ID, m3ua_handle);
>   dissector_add("sctp.port", SCTP_PORT_M3UA, m3ua_handle);

Another (probably better) alternative would be to modify the M3UA 
dissector to register for whatever SCTP port your M3UA traffic is on 
(instead of the well known port of 2905).

Actually, an even better idea would be to make the M3UA dissector's SCTP 
port a configurable preference.