Wireshark-bugs: [Wireshark-bugs] [Bug 1911] ISUP inside RUDP/Cisco SM packets not decoded
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1911
------- Comment #7 from ravasio@xxxxxxxxx 2007-10-16 09:53 GMT -------
Hi,
(In reply to comment #6)
> Hi,
> I've checked in a change in revision 23171 which decodes the SDP inside these
> messages but its mostly gesswork and more info is required to get a good
> dissection of these messages.
Thanks a million for checking this in. I made some mistakes and reported
incorrect information. Cisco uses two version of ISUP signalling transported on
RUDP:
1) ISUP - used between Cisco PGW and Cisco SLT devices, uses RUDP with default
port number 7000. Protocol stack is RUDP->Cisco SM->MTP3->ISUP. This has always
been properly decoded by Wireshark/Ethereal
2) EISUP - used between Cisco HSI and Cisco PGW devices, uses RUDP with default
port number 8003. Protocol stack is RUDP->Cisco SM->SDP. This implementation is
PROPRIETARY and before version 23171 we had never been able to decode this
packet in Wireshark/Ethereal.
With the modification you applied we can now decode both. I am not sure the
implementation is correct and will always work but, as I said, EISUP is
unfortunately a proprietary protocol and Cisco is not willing to release any
documentation on this (not to me, at least)
To see an example of a complete call flow in such a (pretty common) Cisco
platform, please see the trace file (outbound-call-example.pcap) I'm attaching.
Packet 292 is an example of EISUP proprietary signalling, packet 291 is an
example of standard ISUP packet.
...It would be great to add the capability of including ISUP and EISUP messages
into the statistics->VoIP calls graph...
Thanks again,
Pietro
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
