Wireshark · Wireshark-users: Re: [Wireshark-users] not able to decode TCAP/GSM_MAP/GSM_SMS protocol layers

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Zak, Pavel wrote:
> Hi,
>
> I currently have wireshark 1.2.9 and I’m not able to decode M3UA traffic 
> exchanged between SMSC and STP. Decoding ends up on 
> ETH/IP/SCTP/M3UA/SCCP layer and the rest is non decoded raw data.
>
> Could anyone tell me what’s wrong in the traffic? Please see HTML output 
> bellow (left side correctly decoded, right side incorrectly).

The message on the right has no SSNs in the SCCP Called/Calling 
addresses.  Wireshark uses the SSN to know that the message is TCAP (as 
opposed to some other upper-layer protocol).

I suppose that if this is really a problem SCCP could have a preference 
for a "default" upper layer protocol if none is found via SSNs.