GSM DTAP malformed packet
Hello everyone.
I've got a packet that is technical a call setup from a PRI plugged into a Cisco AS5400. This message is passed via IUA to a server.
Wireshark sees this as "Stream Control Transmission Protocol" > ISDN Q.921-User Adaptation Layer > Radio Signalling Link (RSL) > GSM A-I/F DTAP.
Wireshark complains that this is a malformed GSM DTAP message. And doesn't seem to display any of the raw ISDN message as it comes off the PRI (I'm looking for stuff like called number, source number..etc). I know it's in this particular packet, Because it can be seen in the lower raw section.
I'm not really sure what the message should be. But I don't think it's RSL. Disabling RSL and GSM DTAP just leave the data undecoded.
Screenshot
http://cdn.141networks.com/images/mal...
Comments
Have you played around with the various dissection preferences of the protocols?
Yes, Took a few settings to even get it this far. Specifically the RUDP port and some MTP3 stuff. However, I've not been able to find GSM A-I/F DTAP in the protocols portion of preferences. If I right click on the field in the capture. I get the option to "disable GSM DTAP". Which seems to mean I should find it in the protocol list. But I've not found it. Closest thing is GSMTAP. And none of the settings there make any difference.