You might want to use the match_string field of the packet_info struct for
this purpose to give it a try; afterwards we may want to add a
"parent_proto" to this struct.
Regards,
Olivier
----- Original Message -----
From: "Michael Lum"
> OK, seems like a bit of work for the generic case.
>
> I have a simpler case, my A-interface is SCCP being carried
> on a proprietary TCP protocol (I mentioned a long time ago).
>
> I know that the SCCP carried on that proprietary protocol
> is always ANSI. Can the SCCP protocol determine what dissector
> was called just before it? i.e. MTP3, M3UA, or my proprietary protocol ?
>
> If not, I was thinking of using the private_data member of packet_info.
>
> Thanks for your help!
>
> > -----Original Message-----
> > From: Jeff Morriss
> >
> > Guy Harris wrote:
> >
> > >
> > > On Jan 7, 2004, at 2:45 PM, Michael Lum wrote:
> > >
> > >> I have ANSI MTP3/ANSI SCCP on one SS7 link for the A-interface
> > >> (Base Station Controller to Mobile Switching Center) and
> > >> ITU MTP3/ITU SCCP/ANSI TCAP on another SS7 link for the ANSI MAP
> > >> interface
> > >> (MSC to whatever, MC/HLR, etc.).
> > >>
> > >> Currently the SCCP dissector uses the extern 'mtp3_standard'
> > provided by
> > >> the MTP3 dissector. Obviously this causes a problem with the
> > >> configuration
> > >> above.
> > >
> > >
> > > Because both links are in one capture? (If they're in separate
> > > captures, you'd change the setting before or after reading in a file.)
> > >
> > > If so, then you'd need some way of making that a per-link property,
> > > which would need
> > >
> > > 1) a mechanism for setting non-global properties through the UI,
if
> > > it can't be determined from the traffic;
> > >
> > > 2) a mechanism for specifying the link.
> >
> > I suppose it *might* be possible for the SS7 dissectors to determine the
> > standard heuristically (on a message by message basis)? Sounds painful
> > to me, but it might work.
> >
> > Of course, we could get then into issues like "what if MTP3 determines
> > the standard is ITU but SCCP determines the standard should be ANSI"? I
> > guess a global "I already decided the standard" flag could be used to
> > clear that problem (while allowing the lowest-level protocol to be MTP3
> > or M3UA or SCCP or...).
