Wireshark-dev: Re: [Wireshark-dev] [RANAP truncated] - 1.10.5
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Pascal Quantin <pascal.quantin@xxxxxxxxx>
Date: Sun, 30 Nov 2014 18:25:16 +0100
2014-11-29 12:59 GMT+01:00 Michal Mazurek (mimazure) <mimazure@xxxxxxxxx>:

Hello,

 

While trying to create a fake RANAP packet I experience a problem that if a RANAP packet is longer than 1 octet (i.e. RANAP SCCP parameter is longer than 1 octet) Wireshark fails to decode the whole RANAP content.

It does not take into account 2 octet length 017A, dissector is provided only with 7A length and only this gets decoded. Long data SCCP parameter shall be working.

 

Is there any coding issue from my side while dumping the packet ?

 

Tested on version 1.10.5 (SVN Rev 54262 from /trunk-1.10).


Hi Michal,

from what I can see in the SCCP dissector source code, you should use a Long Unitdata SCCP message (and not a Unitdata SCCP message)  if you want to code the payload length on 2 bytes.

Regards,
Pascal.