Wireshark · Wireshark-users: Re: [Wireshark-users] Hex Stream Decode (SCCP)

[Hoosain Madhi <madhih@xxxxxxxxxxxxx>]

Hi Wireshark Users

In a previous post I was trying to decode a hexdump originating from an STP/VLR. A text2pcap -l 141 sccp_hex.txt sccp_hex.pcap solved my problem in that I was able to import the pcap file into wireshark.

I am now trying to decode a messageDump originating on an SGSN, however -l 141 does not work. Any Ideas on what message I am dealing with and how I can decode.

The messageDump is reproduced below :

e10000000106040f42b04850d1233340d1273945d429374f08000000000000000782117807a40e038b2000f30a40000000002ca48b3a40382647cea
4023a0000000027010000030044624248046000e5d36b1a281806070011860501 0101a00d600ba109060704000001000e036c1ea11c02010102013
83014800802083103715994f7020103050081008301010504765d702ba0068300840204249e5d9e040e66016563a45818846df1f99d07398301018d4402
088945d48b45d48945e083ec04ff75e8ff75e0ff75e4ff75dce84b510000588845d833c08a45c53c097406408845c5eba3c745ecfe0000008d45ec8945dc8d0
5d46000008945e48d05d460

--
Hoosain Madhi
Network Quality - Service Assurance
Group Mobile Engineering
Vodacom

----------------------------------------------------------------------------------------------
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Wed, 23 Jul 2008 09:40:37 -0400

Actually it appears to me that the capture starts at the MTP3 SIO (0x83 is SCCP in a national network). Following your step 1 but substituting this for step 2):

text2pcap -l 141 sccp_hex.txt sccp_hex.pcap

results in a capture file that decodes MTP3, SCCP, TCAP, and GSM MAP portions reasonably (the resulting locationInfoWithLMSI has a country code of South Africa which matches Hoosain's email address so I presume this is a proper decoding).

(Doing this also means you can skip step 3.)


----------
Abhik Sarkar wrote:

Hi!

Looking at the dump it looks like like messageDump is not an SCCP
message, but SCCP payload (a MAP returnError). Do decode this...

Step 1) In a plain text file, put the dump as in the following line:
0000 83 28 22 82 d8 09 01 03 0e 19 0b 12 [... and so on until the end
of the dump with the 'H in the end, with a space in the end before the
EOL and a space in between every byte]
Step 2) text2pcap -l 150 pdu.txt pdu.cap
Step 3) In Wireshark (version 1.0.x), before opening the file, go to
Edit > Preferences > Protocols > DLT_USER > Edit > New
Add a mapping for DLT 150 to payload_proto "gsm_map"... save and close
all dialog.
Step 4) Now, open the generated capture file.

Good luck!
Abhik.

On Tue, Jul 22, 2008 at 10:31 AM, Hoosain Madhi <madhih@xxxxxxxxxxxxx> wrote:

Good day

We are trying to decode a HEX stream that part of a Q3 message generated on
a Siemens STP (SSNC). The output in Q3 format is shown below. The part that
we interested in is the messageDump reproduced below for convenience.  The
Dump is in Hex Format and is actually an SCCP message. We Need to decode
this message in a human readable format.

1. Any idea on how to convert to a format that Wireshark will understand?
2. This message may require a dummy MTP layer to be added.
3. Commercial protocol analyzers require a 00000F appended to the beginning
of the message.


                                             messageDump
'83282282d80901030e190b12080011044326926911010b1206001
 1047228191063065d645b49045bba830a6b2a2828060700118605010101a01d611b80020780a109060704000001001403a203020100a305a10302010
 06c27a225020101302002012d301b040856058123002025f9a00f8107917228194040f704040001a115'H,

“This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.co.za/legal/email.jsp "