Re: SV: [Fwd: [Ethereal-dev] 3G Signaling patch]

[Rene Pilz <rene.pilz@xxxxxx>]

Attached is the patch for the discussed heuristics.

/rene

On Tue, 2005-10-04 at 10:34 -0700, Guy Harris wrote:
> Rene Pilz wrote:
>
> > I would propose this algorithm:
> > a) if aal5 len < 14 bytes then dissect as sscop
> > b) if aal5 len >= 14 bytes and the fist byte is 0x81 or 0x83 then 
> > dissect as sscop
> > 
> > As I have seen until now, there should be no MAC address collision with 
> > this solution.
>
> The lowermost bit of the first octet of a MAC address is the 
> individual/group bit, so that'd only collide with a multicast address 
> beginning with 0x81/0x83; I think most of the standard ones, at least, 
> seem to start with 0x01.
>
> > Is it fine for you?
> > Should I also consider Q.2931 as you proposed?
>
> The heuristics you mention should be sufficient.
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev

-- 
Dipl-Ing (FH) MSc. C.E René Pilz
ftw. Telekommunications Research Center Vienna http://www.ftw.at
Tech Gate Vienna, Donaucitystraße 1, A-1220 Wien
Mobile: +43 664 8269871 Office: +43 1 5052830-13  Fax: +43 1 5052830-99

Index: wiretap/atm.c
===================================================================
--- wiretap/atm.c	(revision 16117)
+++ wiretap/atm.c	(working copy)
@@ -81,6 +81,21 @@
 			 * multiplexed RFC 1483 traffic.
 			 */
 			pseudo_header->atm.type = TRAF_LLCMX;
+		} else if (pseudo_header->atm.aal5t_len < 14) {
+			/*
+			 * As this cannot be an ethernet frame
+			 * (less than 14 bytes) we can try it
+			 * as a SSCOP frame
+			 */
+			pseudo_header->atm.aal = AAL_SIGNALLING;
+		} else if (pd[0] == 0x83 || pd[0] == 0x81) {
+			/*
+			 * MTP3b headers often encapsulate
+			 * a SCCP or MTN in the 3G network.
+			 * This should cause 0x83 or 0x81
+			 * in the first byte.
+			 */
+			pseudo_header->atm.aal = AAL_SIGNALLING;
 		} else {
 			/*
 			 * Assume it's LANE.