[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #33 from conall.prenderg...@anam.com ---
Verified this latest build on this issue as well as the issues described at
13739, and also with a single continue.

Good work here Pascal, enjoy your vacation :)

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #32 from Gerrit Code Review  ---
Change 23090 merged by Pascal Quantin:
TCAP: fix infinite loop introduced in g35f9349396

https://code.wireshark.org/review/23090

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #31 from Gerrit Code Review  ---
Change 23089 merged by Pascal Quantin:
TCAP: more fixes for SRT analysis

https://code.wireshark.org/review/23089

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

Pascal Quantin  changed:

   What|Removed |Added

 Status|IN_PROGRESS |RESOLVED
 Resolution|--- |FIXED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #30 from Gerrit Code Review  ---
Change 23090 had a related patch set uploaded by Pascal Quantin:
TCAP: fix infinite loop introduced in g35f9349396

https://code.wireshark.org/review/23090

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #29 from Gerrit Code Review  ---
Change 23089 had a related patch set uploaded by Pascal Quantin:
TCAP: more fixes for SRT analysis

https://code.wireshark.org/review/23089

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #28 from Gerrit Code Review  ---
Change 23088 merged by Pascal Quantin:
TCAP: fix infinite loop introduced in g35f9349396

https://code.wireshark.org/review/23088

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #27 from Gerrit Code Review  ---
Change 23088 had a related patch set uploaded by Pascal Quantin:
TCAP: fix infinite loop introduced in g35f9349396

https://code.wireshark.org/review/23088

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #26 from Gerrit Code Review  ---
Change 23087 merged by Pascal Quantin:
TCAP: fix infinite loop introduced in g35f9349396

https://code.wireshark.org/review/23087

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #25 from Gerrit Code Review  ---
Change 23087 had a related patch set uploaded by Pascal Quantin:
TCAP: fix infinite loop introduced in g35f9349396

https://code.wireshark.org/review/23087

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

Pascal Quantin  changed:

   What|Removed |Added

 Status|INCOMPLETE  |IN_PROGRESS

--- Comment #24 from Pascal Quantin  ---
(In reply to conall.prendergast from comment #22)
> Hi Guys,
> 
> I just got round to testing this patch set, and I discovered that it hangs
> and eats CPU when a single CONTINUE is fed to tshark.
> 
> Worth noting that it fixed this issue and the issue at Bug 13739.
> 
> I am re-opening this ticket but Im sure its just a simple fix.
> 
> Conall

Thanks for the report. Indeed it's a stupid mistake where I forgot to change a
line when reworking the logic. Sorry for the mistake (note to myself: avoid
coding when you are in vacation with limited time available ;)).

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #23 from conall.prenderg...@anam.com ---
Created attachment 15777
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=15777=edit
Single continue causing tshark to hang

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

conall.prenderg...@anam.com changed:

   What|Removed |Added

 Resolution|FIXED   |---
 Status|RESOLVED|INCOMPLETE

--- Comment #22 from conall.prenderg...@anam.com ---
Hi Guys,

I just got round to testing this patch set, and I discovered that it hangs and
eats CPU when a single CONTINUE is fed to tshark.

Worth noting that it fixed this issue and the issue at Bug 13739.

I am re-opening this ticket but Im sure its just a simple fix.

Conall

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #21 from Gerrit Code Review  ---
Change 23081 merged by Michael Mann:
TCAP: more fixes for SRT analysis

https://code.wireshark.org/review/23081

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #20 from Gerrit Code Review  ---
Change 23081 had a related patch set uploaded by Michael Mann:
TCAP: more fixes for SRT analysis

https://code.wireshark.org/review/23081

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

Michael Mann  changed:

   What|Removed |Added

 Status|CONFIRMED   |RESOLVED
 Resolution|--- |FIXED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #19 from Gerrit Code Review  ---
Change 23048 merged by Michael Mann:
TCAP: more fixes for SRT analysis

https://code.wireshark.org/review/23048

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #18 from Gerrit Code Review  ---
Change 23048 had a related patch set uploaded by Pascal Quantin:
TCAP: more fixes for SRT analysis

https://code.wireshark.org/review/23048

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

Pascal Quantin  changed:

   What|Removed |Added

 Status|INCOMPLETE  |CONFIRMED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #17 from Pascal Quantin  ---
Which is basically what the code used to do until bug 10841 development,
because this was not sufficient either to cover all cases.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #16 from conall.prenderg...@anam.com ---
Yes, so we can link a continue to the begin if the BEGIN's (otid+calling
address) == CONTINUE's (otid+calling) or (dtid+called).. 

However, we also have to record the calling address of the CONTINUE if we are
using (dtid+called) (in the opposite direction of the begin), because we would
need this to match an END to this transaction

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #15 from Pascal Quantin  ---
(In reply to conall.prendergast from comment #14)
> I think it would be possible to use the calling address, as this will never
> change. The only thing that could change is the called address through the
> GT translation.

Unless I'm mistaken, the calling address becomes the called address for a
message in the other direction. And you need to figure out the direction
programatically.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #14 from conall.prenderg...@anam.com ---
I think it would be possible to use the calling address, as this will never
change. The only thing that could change is the called address through the GT
translation.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #13 from Pascal Quantin  ---
(In reply to conall.prendergast from comment #12)
> Do we not know it is coming from the same host that sent the BEGIN because
> the END and the BEGIN have the same SCCP calling address?

The calling address is currently not used for the matching for the reasons I
gave above. I need more thinking to see if we could still use it somehow
without breaking all the other use cases.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #12 from conall.prenderg...@anam.com ---
Do we not know it is coming from the same host that sent the BEGIN because the
END and the BEGIN have the same SCCP calling address?

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #11 from Pascal Quantin  ---
Hi Conall,

that's also my understanding, but that does not allow to differentiate the case
where the END is sent by the same host as the one that sent the BEGIN, from a
END sent by the peer host, when both are using the same transaction id (which
is the case in this log).
In your capture the tid aad0 is used twice by the same machine (MTP3 PC
11330): once as otid for the BEGIN (packet 6) and once as otid for the first
CONTINUE after a BEGIN (packet 8). Given that the MTP3 PC and SCCP GT can
change during the transaction, it cannot be used as an identifier to perform
the matching. So for now I have no clue on how to handle this the best.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #10 from conall.prenderg...@anam.com ---
Hi Pascal,

>From my understanding, the following rules will always apply to a tcap
transaction.

Given that entity A sends a BEGIN to entity B.


For TCAP CONTINUEs to A:
The dtid and sccp called address of the CONTINUE will have the otid and calling
address of the begin. 
The otid will be generated by B on the first CONTINUE and will be constant for
the remainder of the transaction. 
The sccp calling address could be different to what was the in the called
address of the begin.

For TCAP CONTINUEs from A:
The otid and sccp calling address of the CONTINUE will have the otid and
calling address of the BEGIN.
The dtid will be the otid of the first reply (CONTINUE) from B.
The sccp called address will be the sccp calling addresss of the first reply
from B.


For TCAP ENDS from A:
The otid will be blank. 
The dtid will be the otid of the first reply from B.
The sccp called address will be the sccp calling addresss of the first reply
from B.
The sccp calling address will be the calling address of the BEGIN.


For TCAP ENDS to A:
The otid will be blank.
The dtid and sccp called address will have the otid and calling address of the
begin. 
The calling address will have the calling address of the first reply from B.



As far as I know, there will only ever be one TCAP transaction between any two
sccp parties.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #9 from Pascal Quantin  ---
(In reply to conall.prendergast from comment #8)
> Could we use the SCCP calling GT? 
> Taking into account a possible change in the first replay, as mentioned by
> Vasil here. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13739#c6

And in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13739#c8 he says
that it will not work either.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #8 from conall.prenderg...@anam.com ---
Could we use the SCCP calling GT? 
Taking into account a possible change in the first replay, as mentioned by
Vasil here. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13739#c6

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #7 from Pascal Quantin  ---
So this capture is the opposite of bug 13739. We have a match both for the
source tid / source address, and destination tid / destination address.
Either we test first with the source tid / address, and this solves this bug
but breaks 13739. Or we test first the destination tid / address, and it solves
bug 13739 but breaks this bug.
What extra info could be used to differentiate them?

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #6 from Pascal Quantin  ---
Given than code points can also change and cannot be used as part of the key to
find matches, I do not see how to solve this for now.

How can we differentiate that the end message is sent by the host that also
sent the begin message (what happens in this capture) and not by the
destination host of the begin message (what I always saw in the few captures I
worked on - bug 13739 and 10841).
Here codepoint 11330 is also using aa0 as source tid for packet 6, thus the
mismatch.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #5 from conall.prenderg...@anam.com ---
4c585f would be the otid in this case. 

That TCAP END is being sent by OPC=11334.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #4 from Pascal Quantin  ---
I saw that they use one common tid.
But packet 5 is using source tid 4c585f and packet 17 is using destination tid
aad0. Based on the previous logs in bug 13739, I would have expected it to
be 4c585f instead. Could you please clarify?

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #3 from conall.prenderg...@anam.com ---
Hi Pascal,

Apologies for the confusion.
In the trace above, there are two distinct TCAP transactions, but they happen
to use a common transaction ID (ad0).

You are correct in saying that stid and dtid are stable in a transaction.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

Pascal Quantin  changed:

   What|Removed |Added

 CC||pascal.quan...@gmail.com,
   ||vvvelich...@gmail.com
 Ever confirmed|0   |1
 Status|UNCONFIRMED |INCOMPLETE

--- Comment #2 from Pascal Quantin  ---
Hi Conall,

Packet 17 sends its message to destination tid aad0, which matches the
source tid of packet 6 but not packet 5 (that uses 4c585f).
Packet 18 sends its message to destination tid 4c4b8b that does not match any
begin message.
During the discussion in bug 13739, I was notified that code points could
change so I did the relevant changes. But I was not told that tid could change
also( please keep in mind that I'm not a TCAP user and I do not know how this
is supposed to work nor have currently access to the spec).
Based on the discussion in bug 13739, I assumed that the source tdi /
destination tid were supposed to be stable (sa opposed to the code points that
can change). Is this assumption false? Could you please provide some technical
background or spec content explaining how this is supposed to work?

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13926] TCAP SRT Analysis incorrectly matched TCAP begins and ends

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13926

--- Comment #1 from conall.prenderg...@anam.com ---
Correction. 
v2.2.7 does not address the issue in bug 13737

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe