James Lee
2007-11-30 00:50:40 UTC
Hi. I'm trying to use wireshark to decode raw SCCP packets; i.e. the
contents of an SCCP packet sent over an SS7 link, but where we have only the
packet from the SCCP layer upwards available (so none of the lower-layer
protocols like MTP3, MTP2, etc.).
Now I'm trying to do this by outputting the contents of the SCCP message to
a binary ASCII file, and then running text2pcap over it as follows:
"text2pcap -l 142 input.txt output.pcap" - where 142 is the value of
DLT_SCCP which should be the correct link-layer type here I believe?
Text2pcap is perfectly happy and produces an pcap output file.
When I try to load this file in wireshark, I just get an error complaining
about an unknown link layer type of 142. For comparison, I've tried running
the exact same text2pcap command but with "-l 141" (which is DLT_MTP3), and
wireshark opens the file happily and tries to display an mtp3 packet (though
the contents is incorrect as this binary file doesn't contain an mtp3
header).
this correct? If so, then is there a simple way for me to be able to use
wireshark and its associated tools to decode raw SCCP packets? Can I get
text2pcap to add a dummy MTP3 header (in the same way as it adds dummy
UDP/TCP and lower headers to IP traffic)? Is my only option to get my
application to output packets including an MTP3 header? Is there a more
direct way to get wireshark to decode binary data for a single packet?
Any help would be much appreciated here.
contents of an SCCP packet sent over an SS7 link, but where we have only the
packet from the SCCP layer upwards available (so none of the lower-layer
protocols like MTP3, MTP2, etc.).
Now I'm trying to do this by outputting the contents of the SCCP message to
a binary ASCII file, and then running text2pcap over it as follows:
"text2pcap -l 142 input.txt output.pcap" - where 142 is the value of
DLT_SCCP which should be the correct link-layer type here I believe?
Text2pcap is perfectly happy and produces an pcap output file.
When I try to load this file in wireshark, I just get an error complaining
about an unknown link layer type of 142. For comparison, I've tried running
the exact same text2pcap command but with "-l 141" (which is DLT_MTP3), and
wireshark opens the file happily and tries to display an mtp3 packet (though
the contents is incorrect as this binary file doesn't contain an mtp3
header).
From this, and from looking at the source code it looks like wireshark
doesn't support decoding raw SCCP packets unless I'm missing something - isthis correct? If so, then is there a simple way for me to be able to use
wireshark and its associated tools to decode raw SCCP packets? Can I get
text2pcap to add a dummy MTP3 header (in the same way as it adds dummy
UDP/TCP and lower headers to IP traffic)? Is my only option to get my
application to output packets including an MTP3 header? Is there a more
direct way to get wireshark to decode binary data for a single packet?
Any help would be much appreciated here.