Wireshark · Wireshark-dev: [Wireshark-dev] [RANAP truncated]

Wireshark-dev: [Wireshark-dev] [RANAP truncated] - 1.10.5

From: "Michal Mazurek (mimazure)" <mimazure@xxxxxxxxx>

Date: Sat, 29 Nov 2014 11:59:38 +0000

Hello,

While trying to create a fake RANAP packet I experience a problem that if a RANAP packet is longer than 1 octet (i.e. RANAP SCCP parameter is longer than 1 octet) Wireshark fails to decode the whole RANAP content.

It does not take into account 2 octet length 017A, dissector is provided only with 7A length and only this gets decoded. Long data SCCP parameter shall be working.

Is there any coding issue from my side while dumping the packet ?

Tested on version 1.10.5 (SVN Rev 54262 from /trunk-1.10).

Br,

Michal Mazurek

Engineer, Network Consulting

Attachment: RelocationPreparation_RANAP_truncated.pcap
Description: RelocationPreparation_RANAP_truncated.pcap

Follow-Ups:
- Re: [Wireshark-dev] [RANAP truncated] - 1.10.5
  - From: Pascal Quantin

Prev by Date: Re: [Wireshark-dev] Support dissecting REAL (BER) data values
Next by Date: Re: [Wireshark-dev] PSA: QString.toUtf8().constData() pattern is unsafe
Previous by thread: Re: [Wireshark-dev] The possibility of a curses based Wireshark
Next by thread: Re: [Wireshark-dev] [RANAP truncated] - 1.10.5
Index(es):
- Date
- Thread