Wireshark · Wireshark-users: [Wireshark-users] Hex Stream Decode (SCCP)

[Hoosain Madhi <madhih@xxxxxxxxxxxxx>]

Good day

We are trying to decode a HEX stream that part of a Q3 message generated on a Siemens STP (SSNC). The output in Q3 format is shown below. The part that we interested in is the messageDump reproduced below for convenience.  The Dump is in Hex Format and is actually an SCCP message. We Need to decode this message in a human readable format.

1. Any idea on how to convert to a format that Wireshark will understand?
2. This message may require a dummy MTP layer to be added.
3. Commercial protocol analyzers require a 00000F appended to the beginning of the message.


                                             messageDump           '83282282d80901030e190b12080011044326926911010b1206001
 1047228191063065d645b49045bba830a6b2a2828060700118605010101a01d611b80020780a109060704000001001403a203020100a305a10302010
 06c27a225020101302002012d301b040856058123002025f9a00f8107917228194040f704040001a115'H,                                  

-- 
Hoosain Madhi
Network Quality - Service Assurance
Group Mobile Engineering
Vodacom

Output in Q3 format
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 M-GET CONFIRMATION (                                                                                                    
     INVOKE IDENTIFIER       158,                                                                                        
     LINKED IDENTIFIER       2,                                                                                          
     MANAGED OBJECT CLASS    alarmRecord,                                                                                
     MANAGED OBJECT INSTANCE {                                                                                           
                                 logId = string : "SCCP_FAI_0",                                                          
                                 logRecordId = number : 59633                                                            
                             },                                                                                          
     CURRENT TIME            "20080701142851",                                                                           
     ATTRIBUTE LIST          {                                                                                           
                                 objectClass alarmRecord,                                                                
                                 nameBinding logRecord-log,                                                              
                                 managedObjectClass sccpErrorPerformance,                                                
                                 managedObjectInstance {                                                                 
                                     communicationsEntityId = "sccp",                                                    
                                     scrcId = string : "scrc",                                                           
                                     sccpLinkageId = number : 0,                                                         
                                     scannerId = 3                                                                       
                                 },                                                                                      
                                 eventType qualityofServiceAlarm,                                                        
                                 eventTime "20080701134000",                                                             
                                 logRecordId number : 59633,                                                             
                                 loggingTime "20080701134000",                                                           
                                 packages {                                                                              
                                     thresholdInfoPackage,                                                               
                                     GAAGDA1C.additionalInformationPackage, eventTimePackage                             
                                 },                                                                                      
                                 probableCause noRuleForAddress,                                                         
                                 perceivedSeverity warning,                                                              
                                 thresholdInfo {                                                                         
                                     triggeredThreshold noTranslForSpecificAddress,                                      
                                     observedValue      integer : 1                                                      
                                 },                                                                                      
                                 additionalInformation {                                                                 
                                     {                                                                                   
                                         identifier  firstAndIntervalEventInfo,                                          
                                         information FirstAndIntervalEventInfo : {                                       
                                             sccpLinkageLocalName  "LOC-NAT0-N1",                                        
                                             sccpRoutingDomainName "SRIforSM    ",                                       
                                             calledPartyAddress    {                                                     
                                                 addressIndicator {                                                      
                                                     routingIndicator     routeOnGt,                                     
                                                     globalTitleIndicator ttNpEsNa,                                      
                                                     ssnIndicator         TRUE,                                          
                                                     pointCodeIndicator   FALSE                                          
                                                 },                                                                      
                                                 addressField     {                                                      
                                                     ssn         8,                                                      
                                                     globalTitle {                                                       
                                                         gtTranslationType    gtTT : 0,                                  
                                                         gtNumberingPlan      gtNP : iSDNTNP,                            
                                                         gtNatureOfAddress    gtNoA : international,                     
                                                         gtEncodingScheme     gtES : bcdODD,                             
                                                         gtAddressInformation {                                          
                                                             '0011'B, '0100'B, '0110'B, '0010'B, '0010'B, '1001'B,       
                                                             '1001'B, '0110'B, '0001'B, '0001'B, '0001'B                 
                                                         }                                                               
                                                     }                                                                   
                                                 }                                                                       
                                             },                                                                          
                                             callingPartyAddress   {                                                     
                                                 addressIndicator {                                                      
                                                     routingIndicator     routeOnGt,                                     
                                                     globalTitleIndicator ttNpEsNa,                                      
                                                     ssnIndicator         TRUE,                                          
                                                     pointCodeIndicator   FALSE                                          
                                                 },                                                                      
                                                 addressField     {                                                      
                                                     ssn         6,                                                      
                                                     globalTitle {                                                       
                                                         gtTranslationType    gtTT : 0,                                  
                                                         gtNumberingPlan      gtNP : iSDNTNP,                            
                                                         gtNatureOfAddress    gtNoA : international,                     
                                                         gtEncodingScheme     gtES : bcdODD,                             
                                                         gtAddressInformation {                                          
                                                             '0010'B, '0111'B, '1000'B, '0010'B, '1001'B, '0001'B,       
                                                             '0000'B, '0001'B, '0011'B, '0110'B, '0110'B                 
                                                         }                                                               
                                                     }                                                                   
                                                 }                                                                       
                                             },                                                                          
                                             dpc                   {                                                     
                                                 pointCode bit14 : 8744,                                                 
                                                 netId     1                                                             
                                             },                                                                          
                                             opc                   {                                                     
                                                 pointCode bit14 : 8712,                                                 
                                                 netId     1                                                             
                                             },                                                                          
                                             ssn                   8,                                                    
                                             messageDump           '83282282d80901030e190b12080011044326926911010b1206001
 1047228191063065d645b49045bba830a6b2a2828060700118605010101a01d611b80020780a109060704000001001403a203020100a305a10302010
 06c27a225020101302002012d301b040856058123002025f9a00f8107917228194040f704040001a115'H,                                  
                                             siteId                "MP -27                  ",                           
                                             userCode              2004126                                               
                                         }                                                                               
                                     }                                                                                   
                                 }                                                                                       
                             }                                                                                           
 )                                                                                          

“This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.co.za/legal/email.jsp "