Wireshark · Ethereal-users: Re: [Ethereal-users] ethereal M3UA SCCP and TCAP

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Rifat Atar wrote:
> As I was searching the arcives for a similar problem to the one I 
> encounter with decoding a TCAP message,
> I came across this one:
>
> http://www.ethereal.com/lists/ethereal-users/200403/msg00322.html
>
> If anybody has followed up from that point on, could you please advise:
>
> Is the TCAP dissector capable of decoding ANSI TCAP content?

Yes but you have to set the preference 
(Edit->Preferences->Protocols->TCAP) to indicate you'd like it to use 
ANSI TCAP.

> Can someone please elaborate on the TCAP dissecotor being unable to 
> decode unless ssn is between 5 - 12 ?

Modern versions of Ethereal allow you to dissect any SSN as TCAP: again, 
there is a preference for that.  (Sorry, I don't remember in what 
version this capability was added.)

> Does the TCAP dissector attempt to decode the TCAP content based on the 
> value of SCCP layer called address
> subystem number? What if there is no subsystem number (just 0 ) in there?

Actually it will use either the Called or Calling address' SSN.  If 
there is no SSN, TCAP won't pick it up.  (Maybe this is another good 
reason to make the TCAP dissector heuristic?)