2005-06-06 15:39:20 +00:00
|
|
|
/* packet-tcap-template.c
|
2005-06-07 05:50:28 +00:00
|
|
|
* Routines for TCAP
|
|
|
|
* Copyright 2004 - 2005, Tim Endean <endeant@hotmail.com>
|
|
|
|
* Built from the gsm-map dissector Copyright 2004 - 2005, Anders Broman <anders.broman@ericsson.com>
|
2005-06-06 15:39:20 +00:00
|
|
|
*
|
|
|
|
* $Id$
|
2007-07-27 19:24:40 +00:00
|
|
|
*
|
2006-05-21 05:12:17 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2005-06-06 15:39:20 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
* References: ETSI 300 374
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <glib.h>
|
|
|
|
#include <epan/packet.h>
|
|
|
|
#include <epan/prefs.h>
|
2007-08-25 01:14:24 +00:00
|
|
|
#include <epan/oids.h>
|
2007-05-13 20:58:29 +00:00
|
|
|
#include <epan/asn1.h>
|
2008-03-01 17:23:39 +00:00
|
|
|
#include <epan/strutil.h>
|
2005-06-06 15:39:20 +00:00
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
#include "packet-ber.h"
|
|
|
|
#include "packet-tcap.h"
|
2009-08-21 20:32:50 +00:00
|
|
|
#include <epan/tcap-persistentdata.h>
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-06-07 05:50:28 +00:00
|
|
|
#define PNAME "Transaction Capabilities Application Part"
|
2005-06-06 20:42:18 +00:00
|
|
|
#define PSNAME "TCAP"
|
2005-06-06 15:39:20 +00:00
|
|
|
#define PFNAME "tcap"
|
|
|
|
|
|
|
|
/* Initialize the protocol and registered fields */
|
2009-10-11 16:24:29 +00:00
|
|
|
static int proto_tcap = -1;
|
2007-04-23 10:45:00 +00:00
|
|
|
static int hf_tcap_tag = -1;
|
|
|
|
static int hf_tcap_length = -1;
|
2005-06-06 15:39:20 +00:00
|
|
|
static int hf_tcap_data = -1;
|
2005-08-18 21:36:59 +00:00
|
|
|
static int hf_tcap_tid = -1;
|
2005-06-06 15:39:20 +00:00
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
int hf_tcapsrt_SessionId=-1;
|
|
|
|
int hf_tcapsrt_Duplicate=-1;
|
|
|
|
int hf_tcapsrt_BeginSession=-1;
|
|
|
|
int hf_tcapsrt_EndSession=-1;
|
|
|
|
int hf_tcapsrt_SessionTime=-1;
|
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
#include "packet-tcap-hf.c"
|
2005-06-06 15:39:20 +00:00
|
|
|
|
|
|
|
/* Initialize the subtree pointers */
|
|
|
|
static gint ett_tcap = -1;
|
|
|
|
static gint ett_param = -1;
|
|
|
|
|
2005-08-18 21:36:59 +00:00
|
|
|
static gint ett_otid = -1;
|
|
|
|
static gint ett_dtid = -1;
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
gint ett_tcap_stat = -1;
|
2005-08-18 21:36:59 +00:00
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
static struct tcapsrt_info_t * gp_tcapsrt_info;
|
|
|
|
static gboolean tcap_subdissector_used=FALSE;
|
2007-04-03 19:08:00 +00:00
|
|
|
static dissector_handle_t requested_subdissector_handle = NULL;
|
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
static struct tcaphash_context_t * gp_tcap_context=NULL;
|
2005-08-18 21:36:59 +00:00
|
|
|
|
2005-06-06 15:39:20 +00:00
|
|
|
#include "packet-tcap-ett.c"
|
|
|
|
|
|
|
|
#define MAX_SSN 254
|
|
|
|
static range_t *global_ssn_range;
|
|
|
|
static range_t *ssn_range;
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
struct tcap_private_t tcap_private;
|
|
|
|
|
|
|
|
gboolean gtcap_HandleSRT=FALSE;
|
|
|
|
extern gboolean gtcap_PersistentSRT;
|
|
|
|
extern gboolean gtcap_DisplaySRT;
|
|
|
|
extern guint gtcap_RepetitionTimeout;
|
|
|
|
extern guint gtcap_LostTimeout;
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2006-12-07 20:34:08 +00:00
|
|
|
static dissector_handle_t tcap_handle = NULL;
|
2008-12-15 20:52:40 +00:00
|
|
|
static dissector_table_t ber_oid_dissector_table;
|
2005-11-14 10:02:31 +00:00
|
|
|
static const char * cur_oid;
|
|
|
|
static const char * tcapext_oid;
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
static proto_tree * tcap_top_tree=NULL;
|
|
|
|
static proto_tree * tcap_stat_tree=NULL;
|
|
|
|
|
2005-06-06 15:39:20 +00:00
|
|
|
static dissector_handle_t data_handle;
|
2007-08-14 22:05:36 +00:00
|
|
|
static dissector_handle_t ansi_tcap_handle;
|
2005-06-06 15:39:20 +00:00
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
static void raz_tcap_private(struct tcap_private_t * p_tcap_private);
|
2007-05-15 05:49:43 +00:00
|
|
|
static int dissect_tcap_param(asn1_ctx_t *actx, proto_tree *tree, tvbuff_t *tvb, int offset);
|
2007-07-30 17:10:20 +00:00
|
|
|
static int dissect_tcap_ITU_ComponentPDU(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, asn1_ctx_t *actx _U_, proto_tree *tree, int hf_index _U_);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
static GHashTable* ansi_sub_dissectors = NULL;
|
|
|
|
static GHashTable* itu_sub_dissectors = NULL;
|
|
|
|
|
|
|
|
static void dissect_tcap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree);
|
|
|
|
|
|
|
|
extern void add_ansi_tcap_subdissector(guint32 ssn, dissector_handle_t dissector) {
|
|
|
|
g_hash_table_insert(ansi_sub_dissectors,GUINT_TO_POINTER(ssn),dissector);
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("sccp.ssn",ssn,tcap_handle);
|
2005-12-17 16:55:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
extern void add_itu_tcap_subdissector(guint32 ssn, dissector_handle_t dissector) {
|
|
|
|
g_hash_table_insert(itu_sub_dissectors,GUINT_TO_POINTER(ssn),dissector);
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("sccp.ssn",ssn,tcap_handle);
|
2005-12-17 16:55:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
extern void delete_ansi_tcap_subdissector(guint32 ssn, dissector_handle_t dissector _U_) {
|
|
|
|
g_hash_table_remove(ansi_sub_dissectors,GUINT_TO_POINTER(ssn));
|
2007-07-30 17:10:20 +00:00
|
|
|
if (!get_itu_tcap_subdissector(ssn))
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_delete_uint("sccp.ssn",ssn,tcap_handle);
|
2005-12-17 16:55:45 +00:00
|
|
|
}
|
|
|
|
extern void delete_itu_tcap_subdissector(guint32 ssn, dissector_handle_t dissector _U_) {
|
|
|
|
g_hash_table_remove(itu_sub_dissectors,GUINT_TO_POINTER(ssn));
|
2007-07-30 17:10:20 +00:00
|
|
|
if (!get_ansi_tcap_subdissector(ssn))
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_delete_uint("sccp.ssn", ssn,tcap_handle);
|
2005-12-17 16:55:45 +00:00
|
|
|
}
|
|
|
|
|
2006-12-07 20:53:32 +00:00
|
|
|
dissector_handle_t get_ansi_tcap_subdissector(guint32 ssn) {
|
2005-12-17 16:55:45 +00:00
|
|
|
return g_hash_table_lookup(ansi_sub_dissectors,GUINT_TO_POINTER(ssn));
|
|
|
|
}
|
|
|
|
|
2006-12-07 20:53:32 +00:00
|
|
|
dissector_handle_t get_itu_tcap_subdissector(guint32 ssn) {
|
2005-12-17 16:55:45 +00:00
|
|
|
return g_hash_table_lookup(itu_sub_dissectors,GUINT_TO_POINTER(ssn));
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2005-06-06 15:39:20 +00:00
|
|
|
#include "packet-tcap-fn.c"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
const value_string tcap_component_type_str[] = {
|
|
|
|
{ TCAP_COMP_INVOKE, "Invoke" },
|
|
|
|
{ TCAP_COMP_RRL, "Return Result(L)" },
|
2005-06-06 20:42:18 +00:00
|
|
|
{ TCAP_COMP_RE, "Return Error" },
|
2005-06-06 15:39:20 +00:00
|
|
|
{ TCAP_COMP_REJECT, "Reject" },
|
|
|
|
{ TCAP_COMP_RRN, "Return Result(NL)" },
|
|
|
|
{ 0, NULL } };
|
|
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
dissect_tcap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
|
|
|
|
{
|
|
|
|
proto_item *item=NULL;
|
|
|
|
proto_tree *tree=NULL;
|
2007-07-27 19:24:40 +00:00
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
struct tcaphash_context_t * p_tcap_context;
|
2006-10-03 19:24:22 +00:00
|
|
|
dissector_handle_t subdissector_handle;
|
2007-05-13 20:58:29 +00:00
|
|
|
asn1_ctx_t asn1_ctx;
|
2007-08-14 22:05:36 +00:00
|
|
|
gint8 class;
|
|
|
|
gboolean pc;
|
|
|
|
gint tag;
|
|
|
|
|
2010-06-04 19:28:39 +00:00
|
|
|
/* Check if ANSI TCAP and call the ANSI TCAP dissector if that's the case
|
2007-08-14 22:05:36 +00:00
|
|
|
* PackageType ::= CHOICE { unidirectional [PRIVATE 1] IMPLICIT UniTransactionPDU,
|
|
|
|
* queryWithPerm [PRIVATE 2] IMPLICIT TransactionPDU,
|
|
|
|
* queryWithoutPerm [PRIVATE 3] IMPLICIT TransactionPDU,
|
|
|
|
* response [PRIVATE 4] IMPLICIT TransactionPDU,
|
|
|
|
* conversationWithPerm [PRIVATE 5] IMPLICIT TransactionPDU,
|
|
|
|
* conversationWithoutPerm [PRIVATE 6] IMPLICIT TransactionPDU,
|
2010-06-04 19:28:39 +00:00
|
|
|
* abort [PRIVATE 22] IMPLICIT Abort
|
2007-08-14 22:05:36 +00:00
|
|
|
* }
|
2010-06-04 19:28:39 +00:00
|
|
|
*
|
|
|
|
*
|
2007-08-14 22:05:36 +00:00
|
|
|
*/
|
|
|
|
get_ber_identifier(tvb, 0, &class, &pc, &tag);
|
2007-09-12 16:45:53 +00:00
|
|
|
|
2007-08-14 22:05:36 +00:00
|
|
|
if(class == BER_CLASS_PRI){
|
|
|
|
switch(tag){
|
|
|
|
case 1:
|
|
|
|
case 2:
|
|
|
|
case 3:
|
|
|
|
case 4:
|
|
|
|
case 5:
|
|
|
|
case 6:
|
|
|
|
case 22:
|
|
|
|
call_dissector(ansi_tcap_handle, tvb, pinfo, parent_tree);
|
|
|
|
return;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
2007-09-12 16:45:53 +00:00
|
|
|
|
2007-08-14 22:05:36 +00:00
|
|
|
/* ITU TCAP */
|
2007-05-13 20:58:29 +00:00
|
|
|
asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
tcap_top_tree = parent_tree;
|
2007-07-27 19:24:40 +00:00
|
|
|
tcap_stat_tree = NULL;
|
|
|
|
|
2009-08-09 07:59:51 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "TCAP");
|
2005-06-06 15:39:20 +00:00
|
|
|
|
|
|
|
/* create display subtree for the protocol */
|
|
|
|
if(parent_tree){
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
item = proto_tree_add_item(parent_tree, proto_tcap, tvb, 0, -1, FALSE);
|
|
|
|
tree = proto_item_add_subtree(item, ett_tcap);
|
|
|
|
tcap_stat_tree=tree;
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
2005-06-16 07:46:03 +00:00
|
|
|
cur_oid = NULL;
|
|
|
|
tcapext_oid = NULL;
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
raz_tcap_private(&tcap_private);
|
|
|
|
|
|
|
|
pinfo->private_data = &tcap_private;
|
|
|
|
gp_tcapsrt_info=tcapsrt_razinfo();
|
|
|
|
tcap_subdissector_used=FALSE;
|
|
|
|
gp_tcap_context=NULL;
|
2007-05-13 20:58:29 +00:00
|
|
|
dissect_tcap_TCMessage(FALSE, tvb, 0, &asn1_ctx, tree, -1);
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2007-05-13 20:58:29 +00:00
|
|
|
if (gtcap_HandleSRT && !tcap_subdissector_used ) {
|
2007-07-27 19:24:40 +00:00
|
|
|
p_tcap_context=tcapsrt_call_matching(tvb, pinfo, tcap_stat_tree, gp_tcapsrt_info);
|
|
|
|
tcap_private.context=p_tcap_context;
|
2007-05-13 20:58:29 +00:00
|
|
|
|
|
|
|
/* If the current message is TCAP only,
|
2007-07-27 19:24:40 +00:00
|
|
|
* save the Application Context Name for the next messages
|
2007-05-13 20:58:29 +00:00
|
|
|
*/
|
|
|
|
if ( p_tcap_context && cur_oid && !p_tcap_context->oid_present ) {
|
|
|
|
/* Save the application context and the sub dissector */
|
2010-06-04 19:28:39 +00:00
|
|
|
g_strlcpy(p_tcap_context->oid, cur_oid, sizeof(p_tcap_context->oid));
|
2007-07-27 19:24:40 +00:00
|
|
|
p_tcap_context->oid_present=TRUE;
|
2007-05-13 20:58:29 +00:00
|
|
|
if ( (subdissector_handle = dissector_get_string_handle(ber_oid_dissector_table, cur_oid)) ) {
|
|
|
|
p_tcap_context->subdissector_handle=subdissector_handle;
|
2007-07-27 19:24:40 +00:00
|
|
|
p_tcap_context->subdissector_present=TRUE;
|
2007-05-13 20:58:29 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if (gtcap_HandleSRT && p_tcap_context && p_tcap_context->callback) {
|
|
|
|
/* Callback fonction for the upper layer */
|
2007-07-27 19:24:40 +00:00
|
|
|
(p_tcap_context->callback)(tvb, pinfo, tcap_stat_tree, p_tcap_context);
|
2007-05-13 20:58:29 +00:00
|
|
|
}
|
|
|
|
}
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
void
|
|
|
|
proto_reg_handoff_tcap(void)
|
|
|
|
{
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2007-04-21 20:53:35 +00:00
|
|
|
data_handle = find_dissector("data");
|
2008-04-16 14:28:22 +00:00
|
|
|
ansi_tcap_handle = find_dissector("ansi_tcap");
|
2008-12-15 20:52:40 +00:00
|
|
|
ber_oid_dissector_table = find_dissector_table("ber.oid");
|
2007-08-14 22:05:36 +00:00
|
|
|
|
2007-04-21 20:53:35 +00:00
|
|
|
#include "packet-tcap-dis-tab.c"
|
2005-12-17 16:55:45 +00:00
|
|
|
}
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
static void init_tcap(void);
|
2005-08-18 21:36:59 +00:00
|
|
|
|
2005-06-06 15:39:20 +00:00
|
|
|
void
|
|
|
|
proto_register_tcap(void)
|
|
|
|
{
|
|
|
|
|
|
|
|
/* Setup list of header fields See Section 1.6.1 for details*/
|
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_tcap_tag,
|
|
|
|
{ "Tag", "tcap.msgtype",
|
|
|
|
FT_UINT8, BASE_HEX, NULL, 0,
|
2009-06-23 06:02:12 +00:00
|
|
|
NULL, HFILL }
|
2005-06-06 15:39:20 +00:00
|
|
|
},
|
|
|
|
{ &hf_tcap_length,
|
|
|
|
{ "Length", "tcap.len",
|
2007-10-11 22:49:52 +00:00
|
|
|
FT_UINT8, BASE_DEC, NULL, 0,
|
2009-06-23 06:02:12 +00:00
|
|
|
NULL, HFILL }
|
2005-06-06 15:39:20 +00:00
|
|
|
},
|
|
|
|
{ &hf_tcap_data,
|
|
|
|
{ "Data", "tcap.data",
|
2009-06-23 06:02:12 +00:00
|
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
|
|
NULL, HFILL }
|
2005-06-06 15:39:20 +00:00
|
|
|
},
|
2005-08-18 21:36:59 +00:00
|
|
|
{ &hf_tcap_tid,
|
|
|
|
{ "Transaction Id", "tcap.tid",
|
2009-06-23 06:02:12 +00:00
|
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
|
|
NULL, HFILL }
|
2007-04-23 10:45:00 +00:00
|
|
|
},
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
/* Tcap Service Response Time */
|
|
|
|
{ &hf_tcapsrt_SessionId,
|
|
|
|
{ "Session Id",
|
|
|
|
"tcap.srt.session_id",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
2009-06-23 06:02:12 +00:00
|
|
|
NULL, HFILL }
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
},
|
|
|
|
{ &hf_tcapsrt_BeginSession,
|
|
|
|
{ "Begin Session",
|
|
|
|
"tcap.srt.begin",
|
|
|
|
FT_FRAMENUM, BASE_NONE, NULL, 0x0,
|
|
|
|
"SRT Begin of Session", HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_tcapsrt_EndSession,
|
|
|
|
{ "End Session",
|
|
|
|
"tcap.srt.end",
|
|
|
|
FT_FRAMENUM, BASE_NONE, NULL, 0x0,
|
|
|
|
"SRT End of Session", HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_tcapsrt_SessionTime,
|
|
|
|
{ "Session duration",
|
|
|
|
"tcap.srt.sessiontime",
|
|
|
|
FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
|
|
|
|
"Duration of the TCAP session", HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_tcapsrt_Duplicate,
|
2007-07-27 19:24:40 +00:00
|
|
|
{ "Session Duplicate",
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
"tcap.srt.duplicate",
|
2007-07-27 19:24:40 +00:00
|
|
|
FT_FRAMENUM, BASE_NONE, NULL, 0x0,
|
|
|
|
"SRT Duplicated with Session", HFILL }
|
2005-08-18 21:36:59 +00:00
|
|
|
},
|
2007-04-23 10:45:00 +00:00
|
|
|
#include "packet-tcap-hfarr.c"
|
2005-06-06 15:39:20 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
/* Setup protocol subtree array */
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_tcap,
|
|
|
|
&ett_param,
|
2005-08-18 21:36:59 +00:00
|
|
|
&ett_otid,
|
|
|
|
&ett_dtid,
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
&ett_tcap_stat,
|
2005-06-06 15:39:20 +00:00
|
|
|
#include "packet-tcap-ettarr.c"
|
|
|
|
};
|
|
|
|
|
|
|
|
/*static enum_val_t tcap_options[] = {
|
|
|
|
{ "itu", "ITU", ITU_TCAP_STANDARD },
|
|
|
|
{ "ansi", "ANSI", ANSI_TCAP_STANDARD },
|
|
|
|
{ NULL, NULL, 0 }
|
|
|
|
};*/
|
|
|
|
|
|
|
|
module_t *tcap_module;
|
|
|
|
|
|
|
|
/* Register the protocol name and description */
|
2005-06-07 05:50:28 +00:00
|
|
|
proto_tcap = proto_register_protocol(PNAME, PSNAME, PFNAME);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
|
|
|
/* Required function calls to register the header fields and subtrees used */
|
|
|
|
proto_register_field_array(proto_tcap, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
|
|
|
|
2008-04-16 14:28:22 +00:00
|
|
|
tcap_module = prefs_register_protocol(proto_tcap, NULL);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
#if 0
|
|
|
|
prefs_register_enum_preference(tcap_module, "standard", "ITU TCAP standard",
|
2005-06-06 15:39:20 +00:00
|
|
|
"The SS7 standard used in ITU TCAP packets",
|
2005-06-16 07:46:03 +00:00
|
|
|
&tcap_standard, tcap_options, FALSE);
|
|
|
|
#else
|
|
|
|
prefs_register_obsolete_preference(tcap_module, "standard");
|
|
|
|
#endif
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
#if 0
|
|
|
|
prefs_register_bool_preference(tcap_module, "lock_info_col", "Lock Info column",
|
2005-06-06 15:39:20 +00:00
|
|
|
"Always show TCAP in Info column",
|
|
|
|
&lock_info_col);
|
2005-06-16 07:46:03 +00:00
|
|
|
#else
|
|
|
|
prefs_register_obsolete_preference(tcap_module, "lock_info_col");
|
|
|
|
#endif
|
|
|
|
|
2005-06-06 15:39:20 +00:00
|
|
|
/* Set default SSNs */
|
2005-12-17 16:55:45 +00:00
|
|
|
range_convert_str(&global_ssn_range, "", MAX_SSN);
|
2005-06-06 15:39:20 +00:00
|
|
|
ssn_range = range_empty();
|
|
|
|
|
|
|
|
prefs_register_range_preference(tcap_module, "ssn", "SCCP SSNs",
|
2005-06-07 05:50:28 +00:00
|
|
|
"SCCP (and SUA) SSNs to decode as TCAP",
|
2005-06-06 15:39:20 +00:00
|
|
|
&global_ssn_range, MAX_SSN);
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
|
|
|
|
prefs_register_bool_preference(tcap_module, "srt",
|
|
|
|
"Service Response Time Analyse",
|
|
|
|
"Activate the analyse for Response Time",
|
|
|
|
>cap_HandleSRT);
|
|
|
|
|
|
|
|
prefs_register_bool_preference(tcap_module, "persistentsrt",
|
|
|
|
"Persistent stats for SRT",
|
|
|
|
"Statistics for Response Time",
|
|
|
|
>cap_PersistentSRT);
|
2007-04-23 10:45:00 +00:00
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
prefs_register_uint_preference(tcap_module, "repetitiontimeout",
|
|
|
|
"Repetition timeout",
|
|
|
|
"Maximal delay for message repetion",
|
|
|
|
10, >cap_RepetitionTimeout);
|
|
|
|
|
|
|
|
prefs_register_uint_preference(tcap_module, "losttimeout",
|
|
|
|
"lost timeout",
|
|
|
|
"Maximal delay for message lost",
|
|
|
|
10, >cap_LostTimeout);
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
ansi_sub_dissectors = g_hash_table_new(g_direct_hash,g_direct_equal);
|
|
|
|
itu_sub_dissectors = g_hash_table_new(g_direct_hash,g_direct_equal);
|
2005-06-23 22:15:47 +00:00
|
|
|
|
|
|
|
/* 'globally' register dissector */
|
|
|
|
register_dissector("tcap", dissect_tcap, proto_tcap);
|
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
tcap_handle = create_dissector_handle(dissect_tcap, proto_tcap);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
register_init_routine(&init_tcap);
|
|
|
|
}
|
2005-06-06 15:39:20 +00:00
|
|
|
|
|
|
|
|
|
|
|
static void range_delete_callback(guint32 ssn)
|
|
|
|
{
|
2005-12-17 16:55:45 +00:00
|
|
|
if ( ssn && !get_ansi_tcap_subdissector(ssn) && !get_itu_tcap_subdissector(ssn) ) {
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_delete_uint("sccp.ssn", ssn, tcap_handle);
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void range_add_callback(guint32 ssn)
|
|
|
|
{
|
2005-12-17 16:55:45 +00:00
|
|
|
if (ssn && !get_ansi_tcap_subdissector(ssn) && !get_itu_tcap_subdissector(ssn) ) {
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("sccp.ssn", ssn, tcap_handle);
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-12-17 16:55:45 +00:00
|
|
|
static void init_tcap(void) {
|
|
|
|
if (ssn_range) {
|
|
|
|
range_foreach(ssn_range, range_delete_callback);
|
|
|
|
g_free(ssn_range);
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2005-06-06 15:39:20 +00:00
|
|
|
ssn_range = range_copy(global_ssn_range);
|
|
|
|
range_foreach(ssn_range, range_add_callback);
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
tcapsrt_init_routine();
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2007-05-15 05:49:43 +00:00
|
|
|
dissect_tcap_param(asn1_ctx_t *actx, proto_tree *tree, tvbuff_t *tvb, int offset)
|
2005-06-06 15:39:20 +00:00
|
|
|
{
|
2005-06-16 07:46:03 +00:00
|
|
|
gint tag_offset, saved_offset, len_offset;
|
2005-06-06 15:39:20 +00:00
|
|
|
tvbuff_t *next_tvb;
|
|
|
|
proto_tree *subtree;
|
2005-06-16 07:46:03 +00:00
|
|
|
proto_item *pi;
|
2005-07-12 01:01:19 +00:00
|
|
|
gint8 class;
|
2005-06-16 07:46:03 +00:00
|
|
|
gboolean pc;
|
2005-07-12 01:01:19 +00:00
|
|
|
gint32 tag;
|
2005-06-16 07:46:03 +00:00
|
|
|
guint32 len;
|
2007-10-11 22:49:52 +00:00
|
|
|
guint32 tag_length;
|
|
|
|
guint32 len_length;
|
2005-07-12 01:01:19 +00:00
|
|
|
gboolean ind_field;
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
while (tvb_reported_length_remaining(tvb, offset) > 0)
|
2005-06-06 15:39:20 +00:00
|
|
|
{
|
2005-06-16 07:46:03 +00:00
|
|
|
saved_offset = offset;
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
offset = get_ber_identifier(tvb, offset, &class, &pc, &tag);
|
|
|
|
tag_offset = offset;
|
2007-08-24 07:12:04 +00:00
|
|
|
offset = get_ber_length(tvb, offset, &len, &ind_field);
|
2005-06-06 15:39:20 +00:00
|
|
|
len_offset = offset;
|
|
|
|
|
2007-10-11 22:49:52 +00:00
|
|
|
tag_length = tag_offset - saved_offset;
|
|
|
|
len_length = len_offset - tag_offset;
|
|
|
|
|
2005-06-06 15:39:20 +00:00
|
|
|
if (pc)
|
|
|
|
{
|
2007-10-11 22:49:52 +00:00
|
|
|
pi = proto_tree_add_text(tree, tvb, saved_offset,
|
|
|
|
len + (len_offset - saved_offset),
|
|
|
|
"CONSTRUCTOR");
|
2005-06-06 15:39:20 +00:00
|
|
|
subtree = proto_item_add_subtree(pi, ett_param);
|
|
|
|
proto_tree_add_uint_format(subtree, hf_tcap_tag, tvb,
|
2007-10-11 22:49:52 +00:00
|
|
|
saved_offset, tag_length, tag,
|
|
|
|
"CONSTRUCTOR Tag");
|
|
|
|
proto_tree_add_uint(subtree, hf_tcap_tag, tvb, saved_offset,
|
|
|
|
tag_length, class);
|
|
|
|
|
|
|
|
proto_tree_add_uint(subtree, hf_tcap_length, tvb, tag_offset,
|
|
|
|
len_length, len);
|
|
|
|
|
|
|
|
if (len-(2*ind_field)) /*should always be positive unless we get an empty contructor pointless? */
|
|
|
|
{
|
|
|
|
next_tvb = tvb_new_subset(tvb, offset, len-(2*ind_field),
|
|
|
|
len-(2*ind_field));
|
|
|
|
dissect_tcap_param(actx, subtree,next_tvb,0);
|
2007-04-23 10:45:00 +00:00
|
|
|
}
|
2007-10-11 22:49:52 +00:00
|
|
|
|
|
|
|
if (ind_field)
|
|
|
|
proto_tree_add_text(subtree, tvb, offset+len-2, 2, "CONSTRUCTOR EOC");
|
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
offset += len;
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2007-10-11 22:49:52 +00:00
|
|
|
pi = proto_tree_add_text(tree, tvb, saved_offset,
|
|
|
|
len + (len_offset - saved_offset),
|
|
|
|
"Parameter (0x%.2x)", tag);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
subtree = proto_item_add_subtree(pi, ett_param);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2007-10-11 22:49:52 +00:00
|
|
|
proto_tree_add_uint(subtree, hf_tcap_tag, tvb, saved_offset,
|
|
|
|
tag_length, tag);
|
2005-06-06 15:39:20 +00:00
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
proto_tree_add_uint(subtree, hf_tcap_length, tvb,
|
2007-10-11 22:49:52 +00:00
|
|
|
saved_offset+tag_length, len_length, len);
|
|
|
|
|
|
|
|
if (len) /* check for NULLS */
|
|
|
|
{
|
|
|
|
next_tvb = tvb_new_subset(tvb, offset, len, len);
|
|
|
|
dissect_ber_octet_string(TRUE, actx, tree, next_tvb, 0,
|
|
|
|
hf_tcap_data, NULL);
|
|
|
|
}
|
|
|
|
|
2005-06-16 07:46:03 +00:00
|
|
|
offset += len;
|
2005-06-06 15:39:20 +00:00
|
|
|
}
|
|
|
|
}
|
2005-06-16 07:46:03 +00:00
|
|
|
return offset;
|
|
|
|
}
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
|
|
|
|
static void raz_tcap_private(struct tcap_private_t * p_tcap_private)
|
2007-04-23 10:45:00 +00:00
|
|
|
{
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
memset(p_tcap_private,0,sizeof(struct tcap_private_t) );
|
|
|
|
}
|
|
|
|
|
2007-07-27 19:24:40 +00:00
|
|
|
/*
|
|
|
|
* Call ITU Subdissector to decode the Tcap Component
|
|
|
|
*/
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
static int
|
2007-07-30 17:10:20 +00:00
|
|
|
dissect_tcap_ITU_ComponentPDU(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, asn1_ctx_t *actx _U_, proto_tree *tree, int hf_index _U_)
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
{
|
2007-07-27 19:24:40 +00:00
|
|
|
dissector_handle_t subdissector_handle=NULL;
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
gboolean is_subdissector=FALSE;
|
|
|
|
struct tcaphash_context_t * p_tcap_context=NULL;
|
|
|
|
|
2007-04-23 10:45:00 +00:00
|
|
|
/*
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
* ok lets look at the oid and ssn and try and find a dissector, otherwise lets decode it.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Handle The TCAP Service Response Time
|
|
|
|
*/
|
|
|
|
if ( gtcap_HandleSRT ) {
|
2007-04-23 20:20:46 +00:00
|
|
|
if (!tcap_subdissector_used) {
|
2007-07-27 19:24:40 +00:00
|
|
|
p_tcap_context=tcapsrt_call_matching(tvb, actx->pinfo, tcap_stat_tree, gp_tcapsrt_info);
|
|
|
|
tcap_subdissector_used=TRUE;
|
|
|
|
gp_tcap_context=p_tcap_context;
|
|
|
|
tcap_private.context=p_tcap_context;
|
2007-04-23 20:20:46 +00:00
|
|
|
}else{
|
|
|
|
/* Take the last TCAP context */
|
|
|
|
p_tcap_context = gp_tcap_context;
|
|
|
|
tcap_private.context=p_tcap_context;
|
|
|
|
}
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
}
|
|
|
|
if (p_tcap_context) {
|
2007-04-23 20:20:46 +00:00
|
|
|
if (cur_oid) {
|
|
|
|
if (p_tcap_context->oid_present) {
|
|
|
|
/* We have already an Application Context, check if we have
|
|
|
|
to fallback to a lower version */
|
2010-06-04 19:28:39 +00:00
|
|
|
if ( strncmp(p_tcap_context->oid, cur_oid, sizeof(p_tcap_context->oid))!=0) {
|
2007-07-27 19:24:40 +00:00
|
|
|
/* ACN, changed, Fallback to lower version
|
|
|
|
* and update the subdissector (purely formal)
|
2007-04-23 20:20:46 +00:00
|
|
|
*/
|
2010-06-04 19:28:39 +00:00
|
|
|
g_strlcpy(p_tcap_context->oid,cur_oid, sizeof(p_tcap_context->oid));
|
2007-04-23 20:20:46 +00:00
|
|
|
if ( (subdissector_handle = dissector_get_string_handle(ber_oid_dissector_table, cur_oid)) ) {
|
|
|
|
p_tcap_context->subdissector_handle=subdissector_handle;
|
2007-07-27 19:24:40 +00:00
|
|
|
p_tcap_context->subdissector_present=TRUE;
|
2007-04-23 20:20:46 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/* We do not have the OID in the TCAP context, so store it */
|
2010-06-04 19:28:39 +00:00
|
|
|
g_strlcpy(p_tcap_context->oid, cur_oid, sizeof(p_tcap_context->oid));
|
2007-07-27 19:24:40 +00:00
|
|
|
p_tcap_context->oid_present=TRUE;
|
|
|
|
/* Try to find a subdissector according to OID */
|
2007-04-23 20:20:46 +00:00
|
|
|
if ( (subdissector_handle
|
|
|
|
= dissector_get_string_handle(ber_oid_dissector_table, cur_oid)) ) {
|
|
|
|
p_tcap_context->subdissector_handle=subdissector_handle;
|
2007-07-27 19:24:40 +00:00
|
|
|
p_tcap_context->subdissector_present=TRUE;
|
|
|
|
} else {
|
|
|
|
/* Not found, so try to find a subdissector according to SSN */
|
2010-12-20 05:35:29 +00:00
|
|
|
if ( (subdissector_handle = get_itu_tcap_subdissector(actx->pinfo->match_uint))) {
|
2007-07-27 19:24:40 +00:00
|
|
|
/* Found according to SSN */
|
|
|
|
p_tcap_context->subdissector_handle=subdissector_handle;
|
|
|
|
p_tcap_context->subdissector_present=TRUE;
|
|
|
|
}
|
2007-04-23 20:20:46 +00:00
|
|
|
}
|
|
|
|
} /* context OID */
|
|
|
|
} else {
|
|
|
|
/* Copy the OID from the TCAP context to the current oid */
|
|
|
|
if (p_tcap_context->oid_present) {
|
|
|
|
tcap_private.oid= (void*) p_tcap_context->oid;
|
|
|
|
tcap_private.acv=TRUE;
|
|
|
|
}
|
|
|
|
} /* no OID */
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
} /* no TCAP context */
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2007-04-23 20:20:46 +00:00
|
|
|
|
2007-04-23 10:45:00 +00:00
|
|
|
if ( p_tcap_context
|
2007-07-27 19:24:40 +00:00
|
|
|
&& p_tcap_context->subdissector_present) {
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
/* Take the subdissector from the context */
|
|
|
|
subdissector_handle=p_tcap_context->subdissector_handle;
|
|
|
|
is_subdissector=TRUE;
|
|
|
|
}
|
2007-04-03 19:08:00 +00:00
|
|
|
|
|
|
|
/* Have SccpUsersTable protocol taking precedence over sccp.ssn table */
|
|
|
|
if (!is_subdissector && requested_subdissector_handle) {
|
|
|
|
is_subdissector = TRUE;
|
|
|
|
subdissector_handle = requested_subdissector_handle;
|
|
|
|
}
|
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
if (!is_subdissector) {
|
|
|
|
/*
|
|
|
|
* If we do not currently know the subdissector, we have to find it
|
|
|
|
* - first, according to the OID
|
|
|
|
* - then according to the SSN
|
2007-04-23 10:45:00 +00:00
|
|
|
* - and at least, take the default Data handler
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
*/
|
|
|
|
if (ber_oid_dissector_table && cur_oid) {
|
|
|
|
/* Search if we can find the sub protocol according to the A.C.N */
|
2007-04-23 10:45:00 +00:00
|
|
|
if ( (subdissector_handle
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
= dissector_get_string_handle(ber_oid_dissector_table, cur_oid)) ) {
|
2007-04-23 20:20:46 +00:00
|
|
|
/* found */
|
|
|
|
is_subdissector=TRUE;
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
} else {
|
2007-04-23 20:20:46 +00:00
|
|
|
/* Search if we can found the sub protocol according to the SSN table */
|
|
|
|
if ( (subdissector_handle
|
2010-12-20 05:35:29 +00:00
|
|
|
= get_itu_tcap_subdissector(actx->pinfo->match_uint))) {
|
2007-04-23 20:20:46 +00:00
|
|
|
/* Found according to SSN */
|
|
|
|
is_subdissector=TRUE;
|
|
|
|
} else {
|
|
|
|
/* Nothing found, take the Data handler */
|
|
|
|
subdissector_handle = data_handle;
|
|
|
|
is_subdissector=TRUE;
|
|
|
|
} /* SSN */
|
|
|
|
} /* ACN */
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
} else {
|
2007-04-23 20:20:46 +00:00
|
|
|
/* There is no A.C.N for this transaction, so search in the SSN table */
|
2010-12-20 05:35:29 +00:00
|
|
|
if ( (subdissector_handle = get_itu_tcap_subdissector(actx->pinfo->match_uint))) {
|
2007-04-23 20:20:46 +00:00
|
|
|
/* Found according to SSN */
|
|
|
|
is_subdissector=TRUE;
|
|
|
|
} else {
|
|
|
|
subdissector_handle = data_handle;
|
|
|
|
is_subdissector=TRUE;
|
|
|
|
}
|
|
|
|
} /* OID */
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
} else {
|
2007-04-23 20:20:46 +00:00
|
|
|
/* We have it already */
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
}
|
2007-04-23 10:45:00 +00:00
|
|
|
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
/* Call the sub dissector if present, and not already called */
|
|
|
|
if (is_subdissector)
|
2007-07-27 19:24:40 +00:00
|
|
|
call_dissector(subdissector_handle, tvb, actx->pinfo, tree);
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2007-07-27 19:24:40 +00:00
|
|
|
return offset;
|
From Florent Drouin:
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
2006-09-27 20:06:06 +00:00
|
|
|
}
|
|
|
|
|
2007-04-03 19:08:00 +00:00
|
|
|
void call_tcap_dissector(dissector_handle_t handle, tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree) {
|
|
|
|
|
|
|
|
requested_subdissector_handle = handle;
|
|
|
|
|
|
|
|
TRY {
|
|
|
|
dissect_tcap(tvb, pinfo, tree);
|
|
|
|
} CATCH_ALL {
|
|
|
|
requested_subdissector_handle = NULL;
|
|
|
|
RETHROW;
|
|
|
|
} ENDTRY;
|
2007-04-23 10:45:00 +00:00
|
|
|
|
2007-04-03 19:08:00 +00:00
|
|
|
requested_subdissector_handle = NULL;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|