Wireshark · Wireshark-users: Re: [Wireshark-users] Re Hex Stream Decode (SCCP)

Wireshark-users: Re: [Wireshark-users] Re Hex Stream Decode (SCCP)

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>

Date: Wed, 23 Jul 2008 09:51:39 -0400


Oops, I missed these responses when I sent my earlier response.

I am a bit confused because DLT 141 is actually MTP3. From the libpcapsource (bpf.h):

#define DLT_MTP2                140     /* MTP2, without pseudo-header */
#define DLT_MTP3                141     /* MTP3, without pseudo-header or MTP2 */
#define DLT_SCCP                142     /* SCCP, without pseudo-header or MTP2 or MTP3 */

I hope that was just a typo and there's nobody defining DLT_MTP2 to be141...


Hoosain Madhi wrote:

Hi Abhik

Brilliant. Thank you for the guidance.

I have made the following changes :

text2pcap -l 141 pdu.txt pdu.cap(ie. bpf.h : #define DLT_MTP2 141)



and get the following decode

--------------------------------------------------------------------------------------------------------------------------

No. Time SourceDestination Protocol Info1 2008-07-23 09:38:26.000000 87128744 GSM MAP returnResultLast sendRoutingInfoForSM


Frame 1 (128 bytes on wire, 128 bytes captured)
Message Transfer Part Level 3
Signalling Connection Control Part
Transaction Capabilities Application Part
GSM Mobile Application

0000  83 28 22 82 d8 09 01 03 0e 19 0b 12 08 00 11 04   .(".............
0010  43 26 92 69 11 01 0b 12 06 00 11 04 72 28 19 10   C&.i........r(..
0020  63 06 5d 64 5b 49 04 5b ba 83 0a 6b 2a 28 28 06   c.]d[I.[...k*((.
0030  07 00 11 86 05 01 01 01 a0 1d 61 1b 80 02 07 80   ..........a.....
0040  a1 09 06 07 04 00 00 01 00 14 03 a2 03 02 01 00   ................
0050  a3 05 a1 03 02 01 00 6c 27 a2 25 02 01 01 30 20   .......l'.%...0
0060  02 01 2d 30 1b 04 08 56 05 81 23 00 20 25 f9 a0   ..-0...V..#. %..
0070  0f 81 07 91 72 28 19 40 40 f7 04 04 00 01 a1 15   ....r(.@@.......
--------------------------------------------------------------------------------------------------------------------------

The next step is to use tshark to do the decoding on the command line.Any ideas please for Linux.



Much appreciated.

Regards

---------
Hoosain Madhi
Network Quality - Service Assurance
Group Mobile Engineering
Vodacom



-------- Original Message --------
Subject: Wireshark-users Digest, Vol 26, Issue 36

From: wireshark-users-request@xxxxxxxxxxxxx<wireshark-users-request@xxxxxxxxxxxxx>

To: wireshark-users@xxxxxxxxxxxxx <wireshark-users@xxxxxxxxxxxxx>
Date: Tue Jul 22 2008 21:00:02 GMT+0200 (SAST)

Send Wireshark-users mailing list submissions to
        wireshark-users@xxxxxxxxxxxxx

To subscribe or unsubscribe via the World Wide Web, visit
        https://wireshark.org/mailman/listinfo/wireshark-users
or, via email, send a message with subject or body 'help' to
        wireshark-users-request@xxxxxxxxxxxxx

You can reach the person managing the list at
        wireshark-users-owner@xxxxxxxxxxxxx

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Wireshark-users digest..."

------------------------------------------------------------------------

Subject:
Re: [Wireshark-users] Hex Stream Decode (SCCP)
From:
Abhik Sarkar <sarkar.abhik@xxxxxxxxx>
Date:
Tue, 22 Jul 2008 09:11:46 +0200
To:
Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>

To:
Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>

Hi!

Looking at the dump it looks like like messageDump is not an SCCP
message, but SCCP payload (a MAP returnError). Do decode this...

Step 1) In a plain text file, put the dump as in the following line:
0000 83 28 22 82 d8 09 01 03 0e 19 0b 12 [... and so on until the end
of the dump with the 'H in the end, with a space in the end before the
EOL and a space in between every byte]
Step 2) text2pcap -l 150 pdu.txt pdu.cap
Step 3) In Wireshark (version 1.0.x), before opening the file, go to
Edit > Preferences > Protocols > DLT_USER > Edit > New
Add a mapping for DLT 150 to payload_proto "gsm_map"... save and close
all dialog.
Step 4) Now, open the generated capture file.

Good luck!
Abhik.

On Tue, Jul 22, 2008 at 10:31 AM, Hoosain Madhi <madhih@xxxxxxxxxxxxx> wrote:

Good day

We are trying to decode a HEX stream that part of a Q3 message generated on
a Siemens STP (SSNC). The output in Q3 format is shown below. The part that
we interested in is the messageDump reproduced below for convenience.  The
Dump is in Hex Format and is actually an SCCP message. We Need to decode
this message in a human readable format.

1. Any idea on how to convert to a format that Wireshark will understand?
2. This message may require a dummy MTP layer to be added.
3. Commercial protocol analyzers require a 00000F appended to the beginning
of the message.


                                             messageDump
'83282282d80901030e190b12080011044326926911010b1206001
 1047228191063065d645b49045bba830a6b2a2828060700118605010101a01d611b80020780a109060704000001001403a203020100a305a10302010
 06c27a225020101302002012d301b040856058123002025f9a00f8107917228194040f704040001a115'H,

--
Hoosain Madhi
Network Quality - Service Assurance
Group Mobile Engineering
Vodacom



Output in Q3 format
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 M-GET CONFIRMATION
(
     INVOKE IDENTIFIER
158,
     LINKED IDENTIFIER
2,
     MANAGED OBJECT CLASS
alarmRecord,
     MANAGED OBJECT INSTANCE
{
                                 logId = string :
"SCCP_FAI_0",
                                 logRecordId = number :
59633

},
     CURRENT TIME
"20080701142851",
     ATTRIBUTE LIST
{
                                 objectClass
alarmRecord,
                                 nameBinding
logRecord-log,
                                 managedObjectClass
sccpErrorPerformance,
                                 managedObjectInstance
{
                                     communicationsEntityId =
"sccp",
                                     scrcId = string :
"scrc",
                                     sccpLinkageId = number :
0,
                                     scannerId =
3

},
                                 eventType
qualityofServiceAlarm,
                                 eventTime
"20080701134000",
                                 logRecordId number :
59633,
                                 loggingTime
"20080701134000",
                                 packages
{

thresholdInfoPackage,
                                     GAAGDA1C.additionalInformationPackage,
eventTimePackage

},
                                 probableCause
noRuleForAddress,
                                 perceivedSeverity
warning,
                                 thresholdInfo
{
                                     triggeredThreshold
noTranslForSpecificAddress,
                                     observedValue      integer :
1

},
                                 additionalInformation
{

{
                                         identifier
firstAndIntervalEventInfo,
                                         information
FirstAndIntervalEventInfo : {
                                             sccpLinkageLocalName
"LOC-NAT0-N1",
                                             sccpRoutingDomainName
"SRIforSM    ",
                                             calledPartyAddress
{
                                                 addressIndicator
{
                                                     routingIndicator
routeOnGt,
                                                     globalTitleIndicator
ttNpEsNa,
                                                     ssnIndicator
TRUE,
                                                     pointCodeIndicator
FALSE

},
                                                 addressField
{
                                                     ssn
8,
                                                     globalTitle
{

gtTranslationType    gtTT : 0,

gtNumberingPlan      gtNP : iSDNTNP,

gtNatureOfAddress    gtNoA : international,

gtEncodingScheme     gtES : bcdODD,

gtAddressInformation {
                                                             '0011'B,
'0100'B, '0110'B, '0010'B, '0010'B, '1001'B,
                                                             '1001'B,
'0110'B, '0001'B, '0001'B, '0001'B

}

}

}

},
                                             callingPartyAddress
{
                                                 addressIndicator
{
                                                     routingIndicator
routeOnGt,
                                                     globalTitleIndicator
ttNpEsNa,
                                                     ssnIndicator
TRUE,
                                                     pointCodeIndicator
FALSE

},
                                                 addressField
{
                                                     ssn
6,
                                                     globalTitle
{

gtTranslationType    gtTT : 0,

gtNumberingPlan      gtNP : iSDNTNP,

gtNatureOfAddress    gtNoA : international,

gtEncodingScheme     gtES : bcdODD,

gtAddressInformation {
                                                             '0010'B,
'0111'B, '1000'B, '0010'B, '1001'B, '0001'B,
                                                             '0000'B,
'0001'B, '0011'B, '0110'B, '0110'B

}

}

}

},
                                             dpc
{
                                                 pointCode bit14 :
8744,
                                                 netId
1

},
                                             opc
{
                                                 pointCode bit14 :
8712,
                                                 netId
1

},
                                             ssn
8,
                                             messageDump
'83282282d80901030e190b12080011044326926911010b1206001
 1047228191063065d645b49045bba830a6b2a2828060700118605010101a01d611b80020780a109060704000001001403a203020100a305a10302010
 06c27a225020101302002012d301b040856058123002025f9a00f8107917228194040f704040001a115'H,
                                             siteId                "MP
-27                  ",
                                             userCode
2004126

}

}

}

}
 )

"This e-mail is sent on the Terms and Conditions that can be accessed by
Clicking on this link http://www.vodacom.co.za/legal/email.jsp "
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users

“This e-mail is sent on the Terms and Conditions that can be accessed byClicking on this link http://www.vodacom.co.za/legal/email.jsp "



------------------------------------------------------------------------

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users

References:
- Re: [Wireshark-users] Re Hex Stream Decode (SCCP)
  - From: Hoosain Madhi

Prev by Date: Re: [Wireshark-users] Hex Stream Decode (SCCP)
Next by Date: Re: [Wireshark-users] Calculate Http(s) request per second
Previous by thread: Re: [Wireshark-users] Re Hex Stream Decode (SCCP)
Next by thread: Re: [Wireshark-users] http Content-Encoding: gzip not decoding
Index(es):
- Date
- Thread