The stack is: ANSI A-i/f BSAP SCCP SCCP-Lite TCP (port 5000)
The SCCP-Lite dissector is proprietary and is built as a plugin. All of the decodes happen automatically in ethereal (no "Decode As..."). I can see some output from the SCCP-Lite dissector, but none of the packets that contain SCCP data. For example, frame 58 should have 4 more layers of dissection: 57 09:05:47.673156 10.30.109.74 -> 10.30.109.78 MGCP 200 1387 OK 58 09:05:48.237948 10.30.109.74 -> 10.30.109.78 SCCP-Lite UP : 59 09:05:48.330166 10.30.109.78 -> 10.30.109.74 TCP 5000 > 1377 [ACK] Seq=102055585 Ack=417835624 Win=24616 Len=0 60 09:05:49.641602 10.30.109.78 -> 10.30.109.77 M2UA BEAT 61 09:05:49.642658 10.30.109.77 -> 10.30.109.78 M2UA ERR 62 09:05:49.644073 10.30.109.78 -> 10.30.109.77 SCTP SACK 63 09:05:50.120304 10.30.109.74 -> 10.30.109.78 SCCP-Lite UP : 64 09:05:50.136048 10.30.109.78 -> 10.30.109.74 SCCP-Lite DOWN: > -----Original Message----- > From: Guy Harris [mailto:[EMAIL PROTECTED] > Sent: Thursday, November 27, 2003 2:20 PM > To: Michael Lum > Cc: Ethereal > Subject: Re: [Ethereal-dev] tethereal doesn't seem to dissect all layers > > > On Thu, Nov 27, 2003 at 02:11:29PM -0800, Michael Lum wrote: > > Is there something special I have to do to get tethereal to > > dissect all of the protocol layers in the same way as ethereal ? > > That depends on what's causing it not to do so. > > If you had to do a "Decode As..." to get Ethereal to dissect the > protocol in question, you'd have to use the "-d" flag in Tethereal to > achieve the same goal. > > If the dissection only occurs on the second pass through the packet(s) > in question, then either > > 1) there's a bug somewhere such that not enough information is > available in the first pass to dissect it properly > > or > > 2) the information in question is available in the first pass, > but only *after* the packet(s) in question. > > In 1), you'd have to fix the bug, or supply more details so we can try > to fix it. In 2), you're out of luck. > > > I wrote a tap that is not getting called. I don't see the protocol > > dissection happening in tethereal. > > What protocol is it, and what protocols is it running atop?
